LIBP11-KIT-REMOTE.SO(8)

💅 LIBP11-KIT-REMOTE.SO(8) — the p11-kit OpenSSL engine era

okay bestie, welcome to libp11-kit-remote.so, straight out of the System Manager's Manual section 8 💖 this is a PKCS#11 OpenSSL engine, and yes it's giving very niche very powerful, we love that for us.

---

✨ NAME ✨

libp11-kit-remote.so — a PKCS#11 OpenSSL engine based on p11-kit. no cap, that's the whole vibe.

---

🌸 SYNOPSIS 🌸

openssl engine -t -pre SO_PATH:libp11-kit-engine.so -pre LIST_ADD:1 -pre
LOAD
openssl engine -t -pre SO_PATH:libp11-kit-engine.so -pre LIST_ADD:1 -pre
LOAD -pre MODULE_PATH:/usr/lib/pkcs11/gnome-keyring-pkcs11.so dynamic
openssl engine -t -pre SO_PATH:libp11-kit-engine.so -pre LIST_ADD:1 -pre
LOAD -pre MODULE_PATH:unix:path=$XDG_RUNTIME_DIR/p11-kit/pkcs11

---

🦋 DESCRIPTION 🦋

so this is a PKCS#11 engine for OpenSSL, built on top of p11-kit, and the whole point of it is that it can utilize the p11-kit remoting capabilities ✨ remote tokens, over here, living its best life. it's giving main character energy for your crypto stack, fr fr.

---

💜 COMMANDS 💜

• MODULE_PATH — this one sets which PKCS#11 module you're using 🎀 here's the tea though: if it starts with a "/" then it's assumed to be an absolute file path pointing at a PKCS#11 module. otherwise? it's specifying a remote token, written in the exact same format that the "remote" key in pkcs11.conf uses. so like, slash means file, no slash means remote, iykyk 💅
• LOAD_CERT_CTRL — bestie this one is literally used by wpa_supplicant to load a certificate from a CKA_VALUE attribute of a CKO_CERTIFICATE PKCS#11 object 👑 and it takes its argument as a structure that looks like this:

struct {
    const char *uri_string;
    X509 *cert;
} *params = p;

so cute, so specific, so iconic.

---

🎀 FILES 🎀

• /usr/lib/openssl/engines/libp11-kit-engine.so — the OpenSSL engine itself ✨ the moment.
• /usr/lib/pkcs11/p11-kit-client.so — the p11-kit remoting module that gets used to access remote tokens 🌈 that's the one doing the reaching-out.

---

💀 NOTES 💀

okay so real talk, important disclaimer time:

this engine module is experimental and is not up to feature parity with the libp11 based pkcs11_engine — which, fun fact, is what wpa_supplicant uses by default. so keep that in mind 🙈

it might be possible to extend the pkcs11_engine to include the remoting functionality, and in that case this module would be rendered obsolete. dramatic? yes. accurate? also yes 💀

---

⭐ SEE ALSO ⭐

pkcs11.conf(1), p11-kit(8), p11-kit-remote-socket(5), p11-kit-remote@.service(5), engine(3), wpa_supplicant(8)

go read those too, bestie, it's a whole universe 🫶

---

👑 AUTHORS 👑

Lubomir Rintel — legend behavior, honestly 💖

---

and that's a wrap on p11-remote, dated 2017-04-09 🌸 thank you for coming to my ted talk, slay, periodt 💅✨