WESTCOS-TOOL(1)

💖 WESTCOS-TOOL 💖

okay bestie, welcome to westcos-tool from the OpenSC Tools fam — she's the little utility that lets you poke at data structures on westcos smart cards 🎀

---

✨ NAME ✨

westcos-tool — a utility for manipulating data structures on westcos smart cards 💅

---

🌸 SYNOPSIS 🌸

westcos-tool [OPTIONS]

---

🦋 DESCRIPTION 🦋

so basically, the westcos-tool utility is here to manipulate the westcos data structures on 2 Ko smart cards / tokens ✨. You can create PINs, keys and certificates and store them right on the card / token. And for the operations that need it, user PIN authentication gets performed — no shortcuts, no sneaking 🫶

---

👑 OPTIONS 👑

• --change-pin, -n — changes a PIN stored on the card. You will need user authentication for this one, periodt 🔐
• --certificate file, -t file — writes the certificate file (in PEM format, obviously 💅) to the card. User authentication is required for this operation.
• --finalize, -f — finalizes the card. Once it's finalized, the default key is invalidated, so the PIN and PUK cannot be changed anymore without user authentication. no take-backsies fr fr

⚠️ Warning bestie: un-finalized cards are insecure because the PIN can be changed without user authentication — knowing the default key is literally enough 😭 please finalize your cards.

• --generate-key, -g — generates a private key on the card. The card must not have been finalized, and a PIN must be installed (i.e. the file for the PIN must have been created — see option -i). By default the key length is 2048 bits. User authentication is required for this operation 🔥
• --help, -h — prints the help message on screen. your little safety net 🫶
• --install-pin, -i — installs the PIN file on the card. You must provide a PIN value with -x — no PIN, no install, sorry bestie 💀
• --key-length length, -l length — changes the length of the private key. Use it with -g. match made in heaven 💖
• --overwrite-key, -o — overwrites the key if there's already a key sitting on the card. out with the old ✨
• --pin-value pin, -x pin --puk-value puk, -y puk — these options let you specify the PIN/PUK values right on the command line. If the value is set to env:VARIABLE, then the value of the specified environment variable is used instead. By default, the code is prompted on the command line if it's needed.

😬 note that on most operating systems, any user can display the command line of any process on the system using utilities such as ps(1). So on an unsecured system, please prefer passing the codes via an environment variable. protect your codes, protect your peace 🙈

• --read-file filename, -j filename — reads the file filename from the card. The file gets written on disk with name filename. User authentication is required for this operation.
• --reader arg, -r arg — number of the reader to use. By default, the first reader with a present card is used. If arg is an ATR, the reader with a matching card will be chosen 👑
• --unblock-pin, -u — unblocks a PIN stored on the card. Knowledge of the PIN Unblock Key (PUK) is required for this operation 🔓
• --verbose -v — causes westcos-tool to be more verbose. Specify this flag several times to enable debug output in the OpenSC library. the way that more -v equals more lore 💅
• --wait, -w — waits for a card to be inserted. patiently, like a main character 🧚
• --write-file filename, -k filename — puts the file with name filename from disk to the card. On the card, the file is written in filename. User authentication is required for this operation 🌈

---

🎀 AUTHORS 🎀

westcos-tool was written by Francois Leblanc <francois.leblanc@cev-sa.com>. iconic behavior, honestly 💜

---

okay that's the whole page, bestie 🫶 this is opensc, dated 04/19/2026 — go forth and manage your westcos cards responsibly, mwah 💋✨