title: CKR_SESSION_READ_ONLY while creating a keystore by using keytool
body: <p>I am trying to create keystore using these commands:</p>
  <pre><code>openssl genrsa -out ./files/certificates/ca/rootCA.key 2048
  
  openssl \
      req -x509 \
      -new \
      -nodes \
      -key ./files/certificates/ca/rootCA.key \
      -sha256 \
      -days 1024 \
      -out ./files/certificates/ca/rootCA.crt \
      -subj &quot;/C=**/ST=***/L=****/O=***/OU=DevOps&quot; 
  
  </code></pre>
  <p>Then,  trying to create a truststore:</p>
  <pre><code>
  keytool -keystore zookeeper.truststore.jks -alias CARoot -import -file ./rootCA.crt -noprompt -storepass password
  
  </code></pre>
  <p>But it responds with the following error:</p>
  <pre><code>
  keytool error: java.security.KeyStoreException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_SESSION_READ_ONLY&quot;
  
  </code></pre>
  <p>When running as <code>sudo</code>, the file is created empty, with <code>EOFException</code> exception.</p>
  <p>It's hard to see anything meaningful on SO / documentation. Do you know why it happens? I've run it just fine on my Ubuntu WSL2 on Windows with Java 8:</p>
  <pre><code>
  openjdk version &quot;1.8.0_275&quot;
  
  OpenJDK Runtime Environment (build 1.8.0_275-8u275-b01-0ubuntu1~20.04-b01)
  
  OpenJDK 64-Bit Server VM (build 25.275-b01, mixed mode)
  
  </code></pre>
  <p>Same command <code>keytool ...</code> on machine with RHEL 8.3 and Java 8 fails with the error above.</p>