PKCSICSF(1)

💖 PKCSICSF(1) — the openCryptoki era 💖

okay bestie, gather round, because this is the configuration utility for the ICSF token and it's genuinely so useful once you get it. part of the openCryptoki family, manual section 1, iykyk. let's go 🦋

---

✨ SYNOPSIS ✨

pkcsicsf [-h] [-l|-a token name] [-b BINDDN] [-c client-cert-file] [-C
CA-cert-file] [-k privatekey] [-m mechanism] [-u URI]

look at her. gorgeous. no cap. 💅

---

🌸 DESCRIPTION 🌸

so the pkcsicsf utility does two main character things: it lists available ICSF tokens, and it lets you add one specific ICSF token to opencryptoki. that's the whole vibe.

but listen, the order matters here, fr fr: the ICSF token must be added first to opencryptoki. when you do that, two things happen:

1. it creates an entry in the opencryptoki.conf file for the ICSF token
2. it creates a token_name.conf configuration file in the same directory as the opencryptoki.conf file, containing ICSF specific information — and that info is what the ICSF token reads 📖

okay next, the tea: the ICSF token must bind and authenticate to an LDAP server. the supported authentication mechanisms are simple and sasl. one of these mechanisms must be entered when you're listing the available ICSF tokens or when you're adding an ICSF token. and heads up — opencryptoki currently supports adding only one ICSF token. one. that's it. periodt.

now for the admin girlies 👑: the system admin can either let the ldap calls utilize existing ldap configs, like ldap.conf or .ldaprc for bind and authentication information, or set the bind and authentication information within opencryptoki by using this utility and its options. either way, that information will then be placed in the token_name.conf file so it can be used in the ldap calls. and when you're using simple authentication, the user will be prompted for the racf password when listing or adding a token. yes, it will ask. be ready. 🙈

⚠️ and this one is important bestie: the pkcsicsf utility must be run as root when adding an ICSF token to opencryptoki. no root, no token, no exceptions.

---

🎀 OPTIONS 🎀

• -a token name — add the specified ICSF token to opencryptoki. this is the one that needs root, remember 🫶
• -b BINDND — the distinguish name to bind when using simple authentication
• -c client-cert-file — the client certificate file when using SASL authentication
• -C CA-cert-file — the CA certificate file when using SASL authentication
• -h — show usage information
• -k privatekey — the client private key file when using SASL authentication
• -m mechanism — the authentication mechanism to use when binding to the LDAP server (this should be either simple or sasl)
• -l — list available ICSF tokens
• -h — show usage information

💀 not me noticing -h is literally listed twice in the original. iconic behavior honestly. both of them show usage information. we keep both. we don't question it. 💅

---

🗂️ FILES 🗂️

• /etc/opencryptoki/opencryptoki.conf — the opencryptoki config file containing token configuration information ✨
• /etc/opencryptoki/token_name.conf — contains ICSF configuration information for the ICSF token 🎀

---

🦋 SEE ALSO 🦋

• opencryptoki(7)
• pkcsslotd(8)
• pkcsconf(8)

go read those too, bestie, they're part of the lore 🌈

---

openCryptoki · version 3.27.0 · April 2013 — yeah she's an older queen but she still ate 💖 thank you for coming to my ted talk, now go add your token (as root!!) 🫶✨