OPENSC.CONF(5)

📦
version 0.27.1 · 4 versions
, in fedora 43, fedora 44

💖 NAME 💖

opensc.conf — bestie, this is the configuration file for OpenSC. It lives in the OpenSC File Formats section of the manual (section 5, iykyk). 🎀

✨ DESCRIPTION ✨

Okay so here's the tea ☕ — OpenSC goes hunting for its configuration data in this exact order, and whoever wins first, wins:

  1. command-line options
  2. environment variables
  3. Windows registry key in HKEY_CURRENT_USER (if available)
  4. Windows registry key in HKEY_LOCAL_MACHINE (if available)
  5. system-wide configuration file (/etc/opensc.conf)

The configuration file, opensc.conf, is made of blocks, and blocks generally look like this:

key [, name...] {
     block_contents
}

And block_contents is one or more block_items, where a block_item is any one of these three iconic little guys:

  • # comment string
  • key[, name...] = value;
  • block

At the root level, opensc.conf should contain one or more application specific configuration blocks:

app application {
     block_contents
}

And application can be any of these 💅:

  • filename: a configuration block for the application with that specified file path.
  • default: the fall-back configuration block for all applications.
  • opensc-pkcs11: configuration block for the PKCS#11 module (opensc-pkcs11.so).
  • onepin-opensc-pkcs11: configuration block for the PKCS#11 one-PIN-module (onepin-opensc-pkcs11.so).
  • cardmod: configuration block for Windows' minidriver (opensc-minidriver.dll).
  • cardos-tool, cryptoflex-tool, dnie-tool, egk-tool, eidenv, gids-tool, iasecc-tool, netkey-tool, npa-tool, openpgp-tool, opensc-asn1, opensc-explorer, opensc-notify, opensc-tool, piv-tool, pkcs11-tool, pkcs15-crypt, pkcs15-init, pkcs15-tool, sc-hsm-tool, westcos-tool: configuration block for OpenSC tools.

🌸 CONFIGURATION OPTIONS 🌸

  • debug = num; — how much debug info to print (Default: 0). Bigger number = more chaos, sorry, more debug info. 💀
The environment variable OPENSC_DEBUG overwrites this setting. Yes, overwrites. No arguing. 🙈
  • debug_file = filename; — the file where debug output gets written (Default: stderr). The special values stdout and stderr are recognized, bestie. ✨
  • profile_dir = filename; — the PKCS#15 initialization/personalization profiles directory for pkcs15-init(1) (Default: /usr/share/opensc).
If this configuration value is not found on Windows, the registry key Software\OpenSC Project\OpenSC\ProfileDir gets checked instead.
  • disable_colors = bool; — turns off the colors of log messages (Default: false if attached to a console, true otherwise). 🎨
  • disable_popups = bool; — disables the pop-ups of the built-in GUI (Default: false).
  • enable_default_driver = bool; — enables the default card driver (Default: false). Lowkey important: the default card driver is explicitly enabled for opensc-explorer(1) and opensc-tool(1).
  • card_drivers = name...; — the allowlist of card drivers to load at start-up. The special value internal (which is the default) loads all statically linked drivers.

If you supply an unknown driver (i.e. not internal or old), you have to write a separate configuration block for that driver. There's also a special value old that loads all statically linked drivers that may be removed in the future. 👀

You can get the list of supported card driver names from the output of opensc-tool --list-drivers.

The environment variable OPENSC_DRIVER overwrites this setting.
  • ignored_readers = name...; — list of readers to ignore (Default: empty). If any of the comma separated strings listed here is matched in a reader name (case sensitive, partial matching possible), that reader gets ignored by OpenSC, periodt. Use opensc-tool --list-readers to see all currently connected readers. 🦋
  • reader_driver name { block_contents } — configuration of the smart card reader driver, where name is one of:
    • ctapi: see the section called "Configuration of CT-API Readers"
    • pcsc: see the section called "Configuration of PC/SC Readers"
    • openct: see the section called "Configuration of OpenCT Readers"
    • cryptotokenkit: configuration block for CryptoTokenKit readers

See the section called "Configuration of Smart Card Reader Driver".

  • card_driver name { block_contents } — configuration of the card driver, where name is one of:
    • npa: see the section called "Configuration Options for German ID Card"
    • dnie: see the section called "Configuration Options for DNIe"
    • edo: see the section called "Configuration Options for Polish eID Card"
    • eoi: see the section called "Configuration Options for Slovenian eID Card"
    • myeid: see the section called "Configuration Options for MyEID Card"
    • dtrust: see the section called "Configuration Options for D-Trust Signature Cards"
    • any other value: configuration block for an externally loaded card driver
  • card_atr hexstring { block_contents } — on top of the built-in list of known cards in the card driver, you can configure a new card for the driver using the card_atr block. 🃏

For details, see the section called "Configuration based on ATR".

  • disable_hw_pkcs1_padding = value; — disables PKCS#1 v1.5 padding in HW when the card supports doing raw RSA operations. Known parameters:
    • no: PKCS#1 v1.5 padding is enabled in HW when the card supports it.
    • sign: PKCS#1 v1.5 padding is disabled only for signatures (PKCS#1 v1.5 type 1).
    • decipher: PKCS#1 v1.5 padding is disabled only for decryption (PKCS#1 v1.5 type 2).
    • both: PKCS#1 v1.5 padding is disabled both for signatures and decryption (PKCS#1 v1.5 type 1 and 2).

(Default: decipher).

  • openssl_config = path; — specify an OpenSSL configuration file to be loaded into the OpenSC's library context. Ngl, this should not be needed for general operation, but it is needed if you need to configure some specifics of OpenSSL without the need to rebuild OpenSC (for example, configure and load a FIPS provider). For more info about configuring OpenSSL, see config(5) and fips_config(5). (Default: empty).
  • secure_messaging name { block_contents } — configuration options for the secure messaging profile name:
    • module_name = filename; — name of external SM module (Default: libsmm-local.so).
    • module_path = filename; — directory with external SM module (Default: /usr/lib).
If this configuration value is not found on Windows, the registry key Software\OpenSC Project\OpenSC\SmDir gets checked.
  • module_data = value; — specific data to tune the module initialization.
  • mode = value; — secure messaging mode. Known parameters:
    • transmit: in this mode the procedure to securize an APDU is called by the OpenSC general APDU transmit procedure. In this mode all APDUs, except the ones filtered by the card specific procedure, are securized.
    • acl: in this mode APDUs are securized only if needed by the ACLs of the command to be executed.
  • flags = value; — secure messaging type specific flags.
  • kmc = hexstring; — default KMC of the GP Card Manager for the Oberthur's Java cards.
  • ifd_serial = hexstring; — (no extra description, it's just built different 💅)
  • keyset[_aid]_num_enc = value; and keyset[_aid]_num_mac = value; — keyset values from IAM profiles of the Gemalto IAS/ECC cards, with an optional application identifier.
  • framework name { block_contents } — internal configuration options, where name is one of:
    • pkcs15: see the section called "Configuration of PKCS/15 Framework"
(as written in the page: "Configuration of PKCS#15 Framework" — keeping it exactly: pkcs15: see the section called "Configuration of PKCS#15 Framework")
  • pkcs11 { block_contents } — parameters for the OpenSC PKCS11 module.

For details, see the section called "Configuration of PKCS#11".

🧚 Configuration of Smart Card Reader Driver

⭐ Configuration Options for all Reader Drivers

  • max_send_size = num; and max_recv_size = num; — limit command and response sizes (Default: max_send_size = 255, max_recv_size = 256). Some Readers don't propagate their transceive capabilities correctly 😭, so max_send_size and max_recv_size let you set the limits manually — for example, to enable extended length capabilities.
  • enable_escape bool; — detect reader capabilities with escape commands (wrapped APDUs with CLA=0xFF as defined by PC/SC pt. 3 and BSI TR-03119, e.g. for getting the UID, escaped PIN commands and the reader's firmware version, Default: false).

🌈 Configuration of CT-API Readers

  • module filename { ports = nums; } — load the specified CT-API module with the specified number of ports.

💳 Configuration of PC/SC Readers

  • connect_exclusive = bool; — connect to reader in exclusive mode (Default: false)? This option has no effect in Windows' minidriver.
  • disconnect_action = action; — what to do when disconnecting from a card (SCardDisconnect). Valid values are leave, reset, unpower (Default: leave). This option has no effect in Windows' minidriver.
  • transaction_end_action = action; — what to do at the end of a transaction (SCardEndTransaction). Valid values are leave, reset, unpower (Default: leave). This option has no effect in Windows' minidriver.
  • reconnect_action = action; — what to do when reconnection to a card (SCardReconnect). Valid values are leave, reset, unpower (Default: leave). This option has no effect in Windows' minidriver.
  • enable_pinpad = bool; — enable pinpad if detected (PC/SC v2.0.2 Part 10, Default: true). 🔢
  • fixed_pinlength = num; — some pinpad readers can only handle one exact length of the PIN 😤, so fixed_pinlength sets this value so that OpenSC expands the padding to this length (Default: 0, i.e. not fixed).
  • provider_library = filename; — use specific PC/SC provider (Default: libpcsclite.so.1).

🦋 Configuration of OpenCT Readers

  • readers = num; — virtual readers to allocate (Default: 2).

💳 Configuration Options for MyEID Card 💳

  • disable_hw_pkcs1_padding = bool; — bestie, your MyEID card can do the padding thing internally, all by itself, no cap. It wraps the data (aka the hash code) into a DigestInfo ASN.1 structure, following whatever hash algorithm you picked (and rn that's only for SHA1, okay?). Then that DigestInfo gets padded up to the RSA key modulus length using PKCS#1 v1.5, block type 01h. One lil catch tho: the size of the DigestInfo must not exceed 40% of the RSA key modulus length. If that limit is giving you problems (like, say, someone needs RSA 1024 with SHA512 👀), you can just turn this feature off. When it's off, the card driver does all the prep work itself before sending the data (hash code) over to the card. Slay.

Also! PKCS#1 v1.5 padding in HW can be globally disabled with the option disable_hw_pkcs1_padding. And here's the tea: when you use that global option to disable padding, the padding is disabled even though the MyEID-specific option doesn't turn it off. Global wins, periodt.

🇩🇪 Configuration Options for German ID Card 🇩🇪

  • can = value; — the German ID card is dramatic and requires the CAN to be verified before the QES PIN. Problem is, this isn't part of the PKCS#15 profile of the card, so to verify the QES PIN we lowkey need both. You can drop the CAN right here. If you don't, it'll be prompted on the command line or on the reader (depends on what your reader can do 💅).
  • st_dv_certificate = filename; st_certificate = filename; st_key = filename; — QES is only possible with a Comfort Reader (CAT-K), which holds a cryptographic key so it can authenticate itself as a signature terminal (ST). Usually we'll just use the reader's own capability to sign the data. But during development you may specify soft certificates and keys for an ST. An example PKI can be found in the example data for the German ID card emulator[1] 🎀

🇪🇸 Configuration Options for DNIe 🇪🇸

  • user_consent_enabled = bool; — sets up the warning message that shows when you do a signature operation with the DNIe. Only used if compiled with --enable-dnie-ui.
  • user_consent_app = filename; — pick the pinentry application to use if the warning is configured to be displayed via pinentry (Default: /usr/bin/pinentry). Only used if compiled with --enable-dnie-ui.

🇵🇱 Configuration Options for Polish eID Card 🇵🇱

  • can = value; — CAN (Card Access Number – a 6 digit number printed on the right bottom corner of the front side of the document) is required to establish a connection with the card. It might be overwritten by the EDO_CAN environment variable. Currently, it is not possible to set it in any other way. 😭

🇸🇮 Configuration Options for Slovenian eID Card 🇸🇮

  • can = value; — CAN (Card Access Number – a 6 digit number printed on the right bottom corner of the front side of the document) is required to establish a connection with the card. It might be overwritten by the EOI_CAN environment variable. And plot twist: since the CAN is also stored on the card (in encrypted form), it can be used to automatically establish a secure connection — but only if the card is accessed over the contact interface. 🦋

🔐 Configuration Options for D-Trust Signature Cards 🔐

  • can = value; — CAN (Card Access Number – a 6 digit number printed on the front side of the card) is required to establish a connection with the card. It might be overwritten by the DTRUST_CAN environment variable. If you don't specify it here, the CAN will be read from a card specific cache, prompted on the card reader's PIN pad, or prompted interactively — in this exact order:
    1. Environment variable DTRUST_CAN
    2. This configuration file option
    3. PKCS#15 card-specific cache
    4. Pin pad of a PACE-capable card reader
  • can_use_cache = bool; — caches the CAN number of a card once the user has provided it, in the directory file_cache_dir. The cached CAN gets used later so we can skip that interactive prompting moment entirely. This feature is enabled by default. 🫶

🪪 Configuration Options for PIV Card 🪪

🎯 Configuration based on ATR 🎯

  • atrmask = hexstring; — this mask is logically AND'd with a card ATR before comparison with the ATR reference value above. Using this mask lets you identify and configure multiple ATRs as the same card model. So efficient. ✨
  • driver = name; — when enabled, overrides all possible settings from the card driver's built-in card configuration list.
  • name = name; — set the card name, for card drivers that allow it.
  • type = num; — lets you set the exact type of the card, used internally by the card driver. Allowed values can be found in the source code of cards.h. 👑
  • flags = value...; — card flags as a hex value. Multiple values are OR'd together. Depending on the card driver, this lets you fine-tune the capabilities in the card driver for your card. Optionally, some known parameters can be specified as strings:
    • rng: On-board random number source
    • keep_alive: request the card driver to send a "keep alive" command before each transaction, to make sure the required applet is still selected
  • pkcs15emu = name; — when using PKCS#15 emulation, force the emulation driver for specific cards. Required for external drivers, but can be used with built-in drivers too.
  • force_protocol = value; — force protocol selection for specific cards. Known parameters:
    • t0
    • t1
    • raw
  • read_only = bool; — mark card as read/only card in the PKCS#11/Minidriver/BaseCSP interface (Default: false).
  • md_supports_X509_enrollment = bool; — indicate X509 enrollment support at the Minidriver/BaseCSP interface (Default: false).
  • md_guid_as_id = bool; — use the GUID generated for the key as the id in the PKCS#15 structure (Default: false, i.e. auto generated).
  • md_guid_as_label = bool; — use the GUID generated for the key as the label in the PKCS#15 structure (Default: false, i.e. no label set).
  • md_supports_container_key_gen = bool; — card allows generating key pairs on the card (Default: false).
  • md_supports_container_key_import = bool; — card allows importing private keys (Default: false).
  • md_pinpad_dlg_title = value; — window title of the PIN pad dialog (Default: "Windows Security").
  • md_pinpad_dlg_icon = filename; — filename of the icon for the PIN pad dialog; use "" for no icon (Default: Built-in smart card icon).
  • md_pinpad_dlg_main = value; — main instruction of the PIN pad dialog (Default: "OpenSC Smart Card Provider").
  • md_pinpad_dlg_content_user = value; — content of the PIN pad dialog for role "user" (Default: "Please enter your PIN on the PIN pad.").
  • md_pinpad_dlg_content_user_sign = value; — content of the PIN pad dialog for role "user+signature" (Default: "Please enter your digital signature PIN on the PIN pad.").
  • md_pinpad_dlg_content_admin = value; — content of the PIN pad dialog for role "admin" (Default: "Please enter your PIN to unblock the user PIN on the PIN pad.")
  • md_pinpad_dlg_expanded = value; — expanded information of the PIN pad dialog (Default: "This window will be closed automatically after the PIN has been submitted on the PIN pad (timeout typically after 30 seconds).")
  • md_pinpad_dlg_enable_cancel = bool; — allow the user to cancel the PIN pad dialog (Default: false). If this value is set to true, the user needs to click "OK" to start the PIN verification on the PIN pad. The user can choose the default behavior by enabling or disabling the checkbox of the dialog. The setting is saved by the program's full path (program_path) that uses OpenSC.

And listen — the registry key HKCU\Software\OpenSC Project\OpenSC\md_pinpad_dlg_enable_cancel\program_path overwrites this setting with a DWORD set to either 1 (enabled) or 0 (disabled). 👀

  • md_pinpad_dlg_timeout = num; — time in seconds for the progress bar of the PIN pad dialog to tick. 0 removes the progress bar (Default: 30).
  • notify_card_inserted = value; notify_card_inserted_text = value; — notification title and text when the card was inserted (Default: "Smart card detected", ATR of the card).
  • notify_card_removed = value; notify_card_removed_text = value; — notification title and text when the card was removed (Default: "Smart card removed", name of smart card reader).
  • notify_pin_good = value; notify_pin_good_text = value; — notification title and text when the PIN was verified (Default: "PIN verified", "Smart card is unlocked").
  • notify_pin_bad = value; notify_pin_bad_text = value; — notification title and text when the PIN was wrong (Default: "PIN not verified", "Smart card is locked").

🗂️ Configuration of PKCS#15 Framework 🗂️

  • use_file_caching = value; — whether to cache the card's files (like, say, certificates) on disk in file_cache_dir. Possible parameters:
    • yes: Cache all files (public and private).
    • public: Cache only public files.
    • no: File caching disabled.

(Default: public for the following card drivers: atrust-acos (deactivated driver), belpic, cac1, cac, coolkey, dnie, edo, esteid2018, esteid2025, flex (deactivated driver), cyberflex (deactivated driver), gemsafeV1, idprime, itacns, jpki, MaskTech, mcrd (deactivated driver), npa, nqapplet, tcos, dtrust — and otherwise no.)

⚠️ If caching is done by a system process, the cached files may be placed inaccessible from the user account. Use a globally readable and writable location if you wish to share the cached information. And note: the cached files may contain personal data such as name and mail address. 😬
  • file_cache_dir = filename; — where to cache the card's files. The default values are:
    • $XDG_CACHE_HOME/opensc/ (If $XDG_CACHE_HOME is defined)
    • $HOME/.cache/opensc/ (Unix)
    • $USERPROFILE\.eid-cache\ (Windows)
⚠️ If caching is done by a system process, the cached files may be placed inaccessible from a user account. Use a globally readable and writable location if you wish to share the cached information. And note: the cached files may contain personal data such as name and mail address. 😬

Also! The PIV-II card driver supports the history object's list of retired keys and certificates if they are readable in the file cache directory. If the specified object's URL is "http://"DNS name"/"ASCII-HEX OffCardKeyHistoryFile, then the searches for the file name OffCardKeyHistoryFile happen in the cache directory. 🧚

  • use_pin_caching = bool; — use PIN caching (Default: true)?
  • pin_cache_counter = num; — how many times to use a PIN from cache before re-authenticating it (Default: 10)?
  • pin_cache_ignore_user_consent = bool; — okay so</p> older PKCS#11 apps that don't support CKA_ALWAYS_AUTHENTICATE might need this turned on just to get signatures working with certain cards (Default: false). ✨

Pro tip from the page itself: it's recommended you also turn on PIN caching with the use_pin_caching option, so OpenSC can actually hand the PIN to the card when it needs it. 🫶

  • pin_protected_certificate = value; — how to treat a PIN-protected certificate. The known parameters are:
    • protect — the certificate stays PIN-protected. 🔒
    • declassify — let the certificate be read without enforcing verification of the PIN. 👀
    • ignore — straight up ignore PIN-protected certificates. 💀

(Default: protect.)

  • enable_pkcs15_emulation = bool; — turn on pkcs15 emulation (Default: true). 🦋
  • try_emulation_first = bool; — prefer the pkcs15 emulation code before the normal pkcs15 processing (Default: no). Some cards work in emu-only mode, and they don't depend on this option at all. 🙈
  • enable_builtin_emulation = bool; — turn on builtin emulators (Default: true). 🎀
  • builtin_emulators = emulators; — the list of builtin pkcs15 emulators to test (Default: internal).
    • The special value internal will try all the builtin pkcs15 emulators that aren't disabled. 🌈
    • The special value old will try all the disabled pkcs15 emulators. ⭐
  • pkcs11_enable_InitToken = bool; — enable initialization and card recognition (Default: false). 💅
  • emulate name { block_contents } — configuration options for a PKCS#15 emulator, where name is a short name for an external card driver. 👑
    • module = filename; — for pkcs15 emulators loaded from an external shared library/DLL, you need to specify the path name of the module and customize the card_atr example above correctly. 🧚
    • function = name; — get the init function name of the emulator (Default: sc_pkcs15_init_func_ex). ✨
  • application hexstring { block_contents } — configuration of the on-card-application, where hexstring is the application identifier (AID). 💜
    • type = name; — type of application, where name is one of:
      • generic
      • protected

Used to distinguish the common access application from an application for which authentication to perform some operation cannot be obtained with the common procedures (ex. object creation protected by secure messaging). Used by the PKCS#11 module configured to expose a restricted number of slots. (for ex. configured to expose only User PIN slot, User and Sign PINs slots, ...) 🌸

  • model = name;
  • disable = bool; — do not expose the application in the PKCS#15 framework (Default: false). 🙈
  • user_pin = name; — name of the User PIN object that will be used as the main PIN. 🫶
  • sign_pin = name; — name of the PIN object that will be used for signing. ✍️

🔥 Configuration of PKCS#11 🔥

  • max_virtual_slots = num; — maximum number of virtual slots (Default: 16). If there are more slots than defined here, the remaining slots get hidden from PKCS#11. 💅
  • slots_per_card = num; — maximum number of PIN slots per smart card (Default: 4). If the card has fewer PINs than defined here, the remaining number of slots will be empty. For Firefox, Chrome and Chromium, the slots_per_card is set to 1, to avoid prompting for unrelated PINs. Typically, this effectively disables signature PINs and keys. 😭
  • lock_login = bool; — by default, the OpenSC PKCS#11 module will not lock your card once you authenticate to the card via C_Login (Default: false). So other users or other applications are not prevented from connecting to the card and performing crypto operations (which may be possible because you have already authenticated with the card). This setting is not very secure. ⚠️

Also, if your card is not locked, you can encounter problems due to limitations of the OpenSC framework, which still isn't thoroughly tested in the multi-threads environment. 😵‍💫

Your settings will be more secure if you choose to lock your card. Nevertheless, this behavior is a known violation of the PKCS#11 specification. Now once one application has started using your card with C_Login, no other application can use it, until the first one is done and calls C_Logout or C_Finalize. In the case of many PKCS#11 applications this does not happen until you exit the application. 💀

Thus it is impossible to use several smart card aware applications at the same time, e.g. you cannot run both Firefox and Thunderbird at the same time, if both are configured to use your smart card. 😭

  • atomic = bool; — by default, interacting with the OpenSC PKCS#11 module may change the state of the token, e.g. whether a user is logged in or not (Default: false). 🌸

Thus other users or other applications may change or use the state of the token unknowingly. Other applications may create signatures abusing an existing login, or they may logout unnoticed. 🙈

With this setting enabled, the login state of the token is tracked and cached (including the PIN). Every transaction is preceded by restoring the login state. After every transaction a logout is performed. This setting by default also enables lock_login to disable access for other applications during the atomic transactions. 🔥

Please note that any PIN-pad should be disabled (see enable_pinpad), because the user would have to input their PIN for every transaction. 💅

  • init_sloppy = bool; — with this setting disabled, the OpenSC PKCS#11 module will initialize the slots available when the application calls C_GetSlotList. With this setting enabled, the slots will also get initialized when C_GetSlotInfo is called (Default: true). ✨

This setting is a workaround for Java, which does not call C_GetSlotList when configured with a static slot instead of slotListIndex. 🦋

  • user_pin_unblock_style = mode; — user PIN unblock style mode is one of:
    • none (Default): PIN unblock is not possible with the PKCS#11 API. 🚫
    • set_pin_in_unlogged_session: C_SetPIN in unlogged session: PUK is passed as the OldPin argument of the C_SetPIN call. 🔑
    • set_pin_in_specific_context: C_SetPIN in the CKU_SPECIFIC_CONTEXT logged session: PUK is passed as the OldPin argument of the C_SetPIN call. 🔑
    • init_pin_in_so_session: C_InitPIN in CKU_SO logged session: User PIN 'UNBLOCK' is protected by SOPIN. (PUK == SOPIN). 👑
  • create_puk_slot = bool; — create a slot for unblocking the PIN with PUK (Default: false). This way the PKCS#11 API can be used to login with PUK and change a PIN. May cause problems with some applications like Firefox and Thunderbird. ⚠️
  • create_slots_for_pins = mode...; — symbolic names of PINs for which slots are created, where mode is a list of:
    • all (Default): All non-SO-PIN, non-unblocking PINs. 🌈
    • user: The first global or first local PIN. 🫶
    • sign: The second PIN (first local, second global or second local). ✍️

A card can contain more then one PINs or more then one on-card application with its own PINs. Normally, to access all of them with the PKCS#11 API a slot has to be created for all of them. Many slots could be annoying for some of the widely used applications, like FireFox. This configuration parameter allows you to select the PIN(s) for which a PKCS#11 slot will be created. 💅

Only PINs that are initialised, non-SO-PIN, non-unblocking are associated with a symbolic name. ✨

For the module to simulate the opensc-onepin module behavior, use the following option create_slots_for_pins = "user"; 👑

🌈 ENVIRONMENT 🌈

  • OPENSC_CONF — filename for a user defined configuration file. 🎀

If this environment variable is not found on Windows, the registry key Software\OpenSC Project\OpenSC\ConfigFile is checked. 🪟

  • OPENSC_DEBUG — see debug = num; 👀
  • OPENSC_DRIVER — see card_drivers = name...; 🚗
  • CARDMOD_LOW_LEVEL_DEBUG — write minidriver debug information to C:\tmp\md.log, if set to 1. 📝

If this environment variable is not found on Windows, the registry key Software\OpenSC Project\OpenSC\MiniDriverDebug is checked. 🪟

  • PIV_EXT_AUTH_KEY, PIV_9A_KEY, PIV_9C_KEY, PIV_9D_KEY, PIV_9E_KEY — PIV configuration during initialization with piv-tool. 💳
  • PIV_USE_SM, PIV_PAIRING_CODE — PIV configuration during initialization. See Configuration Options for PIV Card. 🔐

🎀 FILES 🎀

  • /etc/opensc.conf — system-wide configuration file. 🗂️
  • /usr/share/doc/opensc/opensc.conf — extended example configuration file. 📖

💜 NOTES 💜

  1. German ID card emulator — https://github.com/frankmorgner/vsmartcard/tree/master/virtualsmartcard/npa-example-data 🧚

and that's a wrap bestie, we literally made it through the whole entire page 🫶✨ this was the opensc manual page for OPENSC.CONF(5), dated 04/19/2026 — iconic, no cap, go forth and configure responsibly 💅👑

📦 where this page comes from