NETKEY-TOOL(1)

💖 NETKEY-TOOL(1) — the OpenSC Tools glow-up 💖

okay bestie, so this is netkey-tool, an administrative utility for NetKey E4 cards, and it lives in the OpenSC Tools family. she's a little niche, she's a little iconic, and she does the stuff the other OpenSC tools simply cannot do with your NetKey E4 card. let's get into it 🫶

---

✨ SYNOPSIS ✨

netkey-tool [OPTIONS] [COMMAND]

---

🌸 DESCRIPTION 🌸

so the whole vibe of netkey-tool is: you run it from the command line, and it does smart card operations on NetKey E4 cards that are genuinely annoying to pull off with the other OpenSC-tools. we're talking things like:

• changing local PINs 🔐
• storing certificates into empty NetKey E4 cert-files 📜
• displaying the initial PUK-value 👀

lowkey a specialist. highkey the only one who can do it. periodt.

---

💅 OPTIONS 💅

• --help, -h — shows a short help message. the classic "what does this thing do again" button 💁
• --pin pin, -p pin — specifies the current value of the global PIN.
• --puk pin, -u pin — specifies the current value of the global PUK.
• --pin0 pin, -0 pin — specifies the current value of the local PIN0 (aka local PIN).
• --pin1 pin, -1 pin — specifies the current value of the local PIN1 (aka local PUK).
• --reader arg, -r arg — the number of the reader to use. by default, the first reader with a present card gets picked. but if arg is an ATR, then the reader with a matching card will be chosen instead 🎯
• -v — makes netkey-tool more verbose. and bestie, you can stack this one multiple times to keep increasing the verbosity. go off 🔥

---

🎀 PIN FORMAT 🎀

so with -p, -u, -0 or the -1, you can specify one of the card's pins. you've got options, queen:

• a plain ascii-string (i.e. 123456)
• a hex-string (i.e. 31:32:33:34:35:36)

a hex-string must consist of exactly n 2-digit hexnumbers separated by n-1 colons. if it doesn't meet that bar? it gets interpreted as an ascii string instead. no cap.

for example: :12:34: and 1:2:3:4 are both pins of length 7, while 12:34 and 01:02:03:04 are pins of length 2 and 4.

the way those colons are doing the absolute most but they're precise about it 💀

---

👑 COMMANDS 👑

okay so when you use netkey-tool with no options or commands at all, it will display information about the smart card's pins and certificates. and the best part? this will not change your card in any aspect (assumed there are no bugs in netkey-tool 🙈). in particular, the tries-left counters of the pins are investigated without doing actual pin-verifications. she's just looking, not touching ✨

if you specify the global PIN via the --pin option, netkey-tool will also display the initial value of the card's global PUK. and if your global PUK was changed, netkey-tool will still display its initial value.

🚨 real talk: there's no way to recover a lost global PUK once it was changed. and there's also no way to display the initial value of your global PUK without knowing the current value of your global PIN. protect that PIN like it's your main character moment, fr fr.

for most of the commands that netkey-tool can execute, you have to specify one pin. one notable exception is the nullpin command — but that one can only be executed once in the lifetime of a NetKey E4 card. one shot. that's it. 😭

---

📜 cert number filename

this command will read one of your card's certificates (as specified by number) and save this certificate into file filename in PEM-format. certificates on a NetKey E4 card are readable without a pin, so you don't have to specify one. no gatekeeping here 💖

📜 cert filename number

this command will read the first PEM-encoded certificate from file filename and store this into your smart card's certificate file number. some of your smart card's certificate files might be readonly, so this will not work with all values of number. if a certificate file is writable you must specify a pin in order to change it. and if you try to use this command without specifying a pin, netkey-tool will tell you which one is needed. she's helpful like that 🫶

🔄 change {pin | puk | pin0 | pin1} new-pin

this changes the value of the specified pin to the given new value. you must specify either the current value of the pin or another pin to be able to do this — and if you don't specify a correct one, netkey-tool will tell you which one is needed. she will absolutely let you know 💅

🦋 nullpin initial-pin

this command can be executed only if the global PIN of your card is in nullpin-state. and listen: there's no way to return back to nullpin-state once you have changed your global PIN. so it's giving limited edition, one-time-only. you don't need a pin to execute the nullpin-command. after a successful nullpin-command, netkey-tool will display your card's initial PUK-value. 🎉

🔓 unblock {pin | pin0 | pin1}

this unblocks the specified pin. you must specify another pin to be able to do this — and if you don't specify a correct one, netkey-tool will tell you which one is needed. freeing your faves from pin jail, we love to see it ⭐

---

🌈 SEE ALSO 🌈

• opensc-explorer(1) — go hang out with her too, iykyk

---

💜 AUTHORS 💜

netkey-tool was written by Peter Koch <pk_opensc@web.de>. absolute legend, we stan 👑

---

and that's the whole page bestie — this was the opensc edition, dated 04/19/2026, and it's filed under NETKEY-TOOL(1). now go forth and be careful with those PUKs, mwah 💋