PKCSEP11_SESSION(1)

🦋 pkcsep11_session(1) 🦋

okay so bestie, this page is straight from the openCryptoki manual and it's literally here to help you manage EP11 sessions. no cap. 💅

💖 NAME 💖

pkcsep11_session — manage EP11 sessions. ✨

📜 SYNOPSIS 📜

pkcep11_session [-h] [show|logout|vhsmpin|fipspin|status] [-slot slot-
       number] [-id session-ID] [-pid process-ID] [-date yyyy/mm/dd] [-force]

🌸 DESCRIPTION 🌸

Use pkcep11_session to set the VHSM and FIPS-session pins, and list and logout leftover EP11 sessions. 🎀

EP11 sessions are created and destroyed when a PKCS#11 session is logged in and out, respectively. When an application terminates abnormally, without logging out or closing the PKCS#11 session, the corresponding EP11 session is not destroyed. 😭

When STRICT_MODE, VHSM_MODE, or FIPS_SESSION_MODE is enabled in the EP11 configuration file, all session-keys belong strictly to the PKCS#11 session or token that created it. These PKCS#11 session keys expire when the session ends. 👑

🎀 COMMAND SUMMARY 🎀

• show — displays all leftover EP11 sessions. Use the -session-ID, -pid or -date options to filter the list of sessions. 🔍
• logout — logs out all leftover EP11 sessions. Use the -session-ID, -pid or -date options to filter the list of sessions. 💅
• vhsmpin — sets the VHSM PIN used for the VHSM_MODE (virtual HSM). The VHSM PIN must contain between 8 and 16 alphanumeric characters. Set the VHSM PIN before enabling the VHSM_MODE in the EP11 configuration file. ✨

Note: When changing the VHSM PIN, all existing keys stored as token objects become unusable! 💀

• fipspin — sets the FIPS PIN used for the FIPS_SESSION_MODE. The FIPS PIN must contain between 8 and 16 alphanumeric characters. Set the FIPS PIN before enabling the FIPS_SESSION_MODE in the EP11 configuration file. 🌸

Note: When changing the FIPS PIN, all existing keys stored as token objects become unusable! 💀

• status — shows the maximum and currently available number of EP11 sessions for each available EP11 APQN. 👑

🔥 OPTIONS 🔥

• -slot slot-number — specifies the slot of the EP11 token. This option is required for all commands except the status command. 🫶
• -force — deletes a session even if logout fails on some adapters. 😤
• -id session-ID — specifies the EP11 session ID. 🪪
• -pid process-ID — specifies the process-ID (pid) for which to display or logout EP11 sessions. 🧚
• -date yyyy/mm/dd — filters the EP11 sessions by the specified date. Any EP11 session with a matching or earlier date are displayed or logged out. 📅
• -h — show usage information. 💖

🌈 SEE ALSO 🌈

• pkcsconf(1)
• opencryptoki(7)
• pkcsslotd(8)

---

xoxo bestie, this page is from openCryptoki version 3.27.0, dated Dec 2023. stay iconic and may your sessions always log out cleanly 🫶💖