SOFTHSM_MIGRATE(1)

✨ softhsm_migrate ✨

okay bestie, welcome to the softhsm_migrate manual page — section 1, the one and only, and she's that girl 💅 this is the tool that scoops your whole crypto life out of a SoftHSM v2 token and drops it, sparkling, into a PKCS#11 module. no cap.

---

🌸 NAME 🌸

softhsm_migrate — migrate SoftHSM v2 tokens to a PKCS#11 module 🦋

---

🎀 SYNOPSIS 🎀

softhsm_migrate [-m|–pkcs11-module MODULE] [-i|–pkcs11-initargs
INITARGS] [-p|–pkcs11-pin PIN] [-s|–pkcs11-slot SLOT] -q|–softhsm2-pin
PIN SOFTHSM2_TOKEN

---

💖 DESCRIPTION 💖

so like, here's the vibe: softhsm_migrate goes and reads cryptographic objects (think keys and certificates, the whole little family) out of a SoftHSM v2 token directory, and imports them into a target PKCS#11 module — Kryoptic, for example, iykyk. ✨

under the hood it's giving detective energy fr fr: it reads the internal SoftHSM v2 .object files, uses the SoftHSM v2 token PIN you hand it to derive the decryption key, decrypts the token's private and secret keys, and then creates equivalent objects over in the target PKCS#11 token. lowkey iconic behaviour. 👑

---

🫶 OPTIONS 🫶

• -m, –pkcs11-module MODULE — the path to the target PKCS#11 module's shared library. point her at the .so and she's off 💫
• -i, –pkcs11-initargs INITARGS — initialization arguments, passed straight to the target PKCS#11 module. it's giving "here's my config, bestie" 🎀
• -p, –pkcs11-pin PIN — the PIN you use to log into the target PKCS#11 token 🔑
• -s, –pkcs11-slot SLOT — the target PKCS#11 slot number 🎰
• -q, –softhsm2-pin PIN — the user PIN of the SoftHSM v2 token. this one is required, no exceptions, because it's literally the thing that decrypts the token's private and secret keys. no PIN, no migration, periodt. 🚨
• SOFTHSM2_TOKEN — the path to the SoftHSM v2 token directory. and just so we're clear, that's the directory that contains the token.object file 🗂️

---

👑 EXIT STATUS 👑

• 0 — success, bestie!! all objects were migrated successfully. slay 💅
• 1-253 — the number of objects that failed to import. so if it's like, 7, that's seven little objects that didn't make it 😭
• 254 (0xFE) — fatal error parsing the SoftHSM v2 token or deriving its decryption key. 💀
• 255 (0xFF) — fatal error loading, initializing, or authenticating to the target PKCS#11 module. also 💀

---

🌈 EXAMPLES 🌈

migrate a SoftHSM v2 token to a Kryoptic token, exactly like this:

softhsm_migrate \
    -m /usr/lib/libkryoptic_pkcs11.so \
    -i /etc/kryoptic/kryoptic.conf \
    -p target_pin \
    -q softhsm_pin \
    /var/lib/softhsm/tokens/9a19985a-9037-e9df-657d-9947f7ba2120

see how the paths and the PINs line up? main character energy. copy it, swap your own values in, go 🦋

---

⭐ SEE ALSO ⭐

• kryoptic(7)
• kryoptic.conf(5)

---

and that's the whole page, bestie 💜 this is the softhsm_migrate manual, section 1, and the footer down at the bottom is literally just vibes — empty parentheses, (), no source, no version, no date, nothing but the void 🙈 so consider this your cute little sign-off instead: no version stamp, no copyright drama, just the tool and the tea. go migrate something iconic ✨🎀