English 
Tiếng ViệtPKCS#11 ERROR CATALOGUE
Return codes and remediation
Stable error categories help applications distinguish a retryable session event from a policy denial or protected-device failure.
01
Return-code catalogue
| Return code | Typical cause | Remediation | Retry |
|---|---|---|---|
| CKR_CRYPTOKI_NOT_INITIALIZED | C_Initialize missing/failed | Initialize once under documented threading model | No |
| CKR_SLOT_ID_INVALID | Unknown or stale slot | Refresh slot list; check failover/token removal | Conditional |
| CKR_SESSION_HANDLE_INVALID | Session invalidated | Open a new session and re-authenticate | Yes |
| CKR_USER_NOT_LOGGED_IN | Operation requires role | Login under approved role | Yes |
| CKR_PIN_LOCKED | Retry threshold exceeded | Follow controlled unlock/recovery | No immediate retry |
| CKR_MECHANISM_INVALID | Mechanism not in release list | Use approved mechanism/profile | No |
| CKR_TEMPLATE_INCONSISTENT | Object/key template violates policy | Correct attributes and policy | No automatic retry |
| CKR_KEY_HANDLE_INVALID | Key missing or handle stale | Rediscover object by CKA_ID | Conditional |
| CKR_DEVICE_ERROR | Backend/provider failure | Collect correlation; apply approved failover | Conditional |
| CKR_BUFFER_TOO_SMALL | Caller buffer insufficient | Resize using returned length | Yes |
02
Audit correlation
Application logs should record the Cryptoki return code, operation, slot/token identifier, correlation ID and redacted backend reference. They must never log PINs, private-key material or unredacted SAD/credential data.