# Greengrass scripts fail on brand new Zymkey 4i **URL:** \ **Category:** Uncategorized\ **Created:** [February 4, 2025, 12:43am UTC](https://community.zymbit.com/t/greengrass-scripts-fail-on-brand-new-zymkey-4i/1733 "2025-02-04T00:43:07Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![techiemac](https://avatars.discourse-cdn.com/v4/letter/t/51bf81/32.png) [@techiemac](https://community.zymbit.com/u/techiemac)\ **Post date:** [February 4, 2025, 12:43am UTC](https://community.zymbit.com/t/greengrass-scripts-fail-on-brand-new-zymkey-4i/1733/1 "2025-02-04T00:43:07Z")
I’m following the instructions here: [https://docs.zymbit.com/tutorials/aws-iot/greengrass/Zymkey%20Getting%20Started%20Guide%20for%20AWS%20IoT%20Greengrass%20Devices\_1.1.pdf](https://docs.zymbit.com/tutorials/aws-iot/greengrass/Zymkey%20Getting%20Started%20Guide%20for%20AWS%20IoT%20Greengrass%20Devices_1.1.pdf) I also commented out the line that installs the awscli since I want to handle the csr out of band. As part of this, I removed the common shell script. However it looks like the line that does the init token is failing with `CKR_SLOT_ID_INVALID: Slot 0 does not exist.`: ```auto sudo zk_pkcs11-util --use-zkslot 0 --init-token --slot 0 --label "greengrass" --pin 1234 --so-pin 1234 ``` However, when I run the command `zk_pkcs11-util --show-slots` I’m getting the following: ```auto Available slots: Slot 0 Slot info: Description: SoftHSM slot ID 0x0 Manufacturer ID: SoftHSM project Hardware version: 2.5 Firmware version: 2.5 Token present: yes Token info: Manufacturer ID: SoftHSM project Model: SoftHSM v2 Hardware version: 2.5 Firmware version: 2.5 Serial number: Initialized: no User PIN init.: no Label: ``` The full output of the `bootstrap-zymbit.sh` script is below. I’m running this on a RPi5 under Raspbian (`uname -r` returns 6.6.51+rpt-rpi-2712) ```auto Hit:1 http://deb.debian.org/debian bookworm InRelease Hit:2 http://deb.debian.org/debian-security bookworm-security InRelease Hit:3 http://deb.debian.org/debian bookworm-updates InRelease Hit:4 http://archive.raspberrypi.com/debian bookworm InRelease Hit:5 https://zk-sw-repo.s3.amazonaws.com/apt-repo-bookworm-aarch64 bookworm InRelease Reading package lists... Done Reading package lists... Done Building dependency tree... Done Reading state information... Done Calculating upgrade... Done The following packages have been kept back: labwc libcamera-ipa libcamera-tools libpipewire-0.3-0 libpipewire-0.3-modules libspa-0.2-bluetooth libspa-0.2-libcamera libspa-0.2-modules linux-headers-rpi-2712 linux-headers-rpi-v8 linux-image-rpi-2712 linux-image-rpi-v8 pipewire pipewire-bin pipewire-pulse python3-libcamera raspberrypi-ui-mods rpicam-apps wf-panel-pi wfplug-connect 0 upgraded, 0 newly installed, 0 to remove and 20 not upgraded. Reading package lists... Done Building dependency tree... Done Reading state information... Done jq is already the newest version (1.6-2.1). python3-pip is already the newest version (23.0.1+dfsg-1+rpt1). opensc is already the newest version (0.23.0-0.3+deb12u2). 0 upgraded, 0 newly installed, 0 to remove and 20 not upgraded. CKR_SLOT_ID_INVALID: Slot 0 does not exist. ERROR: A label for the object must be supplied. Use --label Engine "zymkey_ssl" set. ERROR: bootstrap-common.sh was not found, you will have to manually sign the CSR, activate the certificate, and copy the certificate file back to this device. ``` The error on the last line is a red herring, I delibrately want to manually sign the CSR. ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [February 11, 2025, 10:21pm UTC](https://community.zymbit.com/t/greengrass-scripts-fail-on-brand-new-zymkey-4i/1733/2 "2025-02-11T22:21:27Z")
The output in your first display is the default before you initialize any PKCS slots. First thing you need to do is initialize a PKCS token. You should not include `--use-zkslot 0` for this step. For example: `sudo zk_pkcs11-util --init-token --slot 0 --label "iotkey" --pin 1234 --so-pin 1234` That will return you the PKCS SLOT\_NUMBER you need to use. `zk_pkcs11-util --show-slots` will also show you the SLOT\_NUMBER at this point. It is a big number, like 2042742417. You can now feed that SLOT\_NUMBER into the next command to create a new key object. Specifying `--use-zkslot 0` here says use the ZYMKEY’s slot 0 private key. The command would look like this: `sudo zk_pkcs11-util --use-zkslot 0 --slot 2042742417 --label iotkey --id 2042742417 --pin 1234` There are a couple of ways you can ID the PKCS slots (by label, id, etc.) so your syntax can vary a bit. Main thing is that you need to init the PKCS storage, then use that SLOT\_NUMBER as your slot reference for PKCS activities. The `use-zkslot` references the ZYMKEY’s key slot. Hope that helps you get going.