P11KMIP.CONF(5)

💖 P11KMIP.CONF 💖 (section 5, bestie)

okay so this is p11kmip.conf, the config file for the p11kmip command, part of openCryptoki ✨ she's a whole 5th-section manual page and she's serving.

---

🌸 NAME 🌸

p11kmip.conf — the configuration file for the p11kmip command. that's it, that's the name 💅

---

🦋 DESCRIPTION 🦋

so the p11kmip tool reads /etc/opencryptoki/p11kmip.conf to find out how to connect to a KMIP server and how to interact with a PKCS #11 token repository. like, it's the little note it passes before it goes and does its thing 🫶

you can point it at a custom file path with the environment variable P11KMIP_DEFAULT_CONF_FILE ✨ but if that env var isn't set, it just reads the global /etc/opencryptoki/p11kmip.conf config file. and if that file isn't available? an error message shows up. not a vibe, but that's the rule 😭

---

🎀 SYNTAX 🎀

there are two sections in the config, and both of them are the same shape: a title, brackets, and a set of key-value pairs. very demure, very consistent 💅

the first section configures the connection to the KMIP server. it contains these keywords: host, tls_client_cert, tls_client_key, wrap_key_format, wrap_key_algorithm, wrap_key_size, wrap_padding_method, wrap_hashing_algorithm.

Example:

kmip {
   host = "0.0.0.0:5696"
   tls_client_cert = "/tmp/certs/client_certificate_jane_doe.pem"
   tls_client_key = "/tmp/certs/client_key_jane_doe.pem"

   wrap_key_format = "PKCS1"
   wrap_key_algorithm = "RSA"
   wrap_key_size = 2048
   wrap_padding_method = "PKCS1.5"
   wrap_hashing_algorithm = "SHA-1" }

✨ the kmip attributes, one by one ✨

• the host attribute has to be written in the format "hostname[:port]" when you're using plain TLS. the "hostname" part can be an IPv4 address, an IPv6 address, or a symbolical hostname, and "port" is optional — you use it when you wanna specify a non-standard port number. if "port" isn't specified, 5696 is the default. periodt.
• the tls_client_cert attribute must specify the path to a PEM format file containing the client certificate used for TLS authentication to the KMIP server. 🔐
• the tls_client_key attribute must specify the path to a PEM format file containing the client private key used for TLS authentication to the KMIP server. 🔑
• the wrap_key_format attribute specifies the format used to transmit the wrapping key, and it must be one of "PKCS1", "PKCS8", or "TransparentPublicKey".
• the wrap_key_algorithm attribute specifies the algorithm used for key wrapping. currently only "RSA" is supported. that's the whole menu, bestie 😌
• the wrap_key_size attribute specifies the length of the key used for wrapping. this value must match the length of the actual wrapping and unwrapping key which are provided when the tool is invoked. no cap.
• the wrap_padding_method attribute specifies the padding method used during the key wrap. currently the padding methods "PKCS1.5" and "OAEP" are supported. 🧚
• the wrap_hashing_algorithm specifies the hashing algorithm used by the padding method. only the "OAEP" padding method requires a hashing algorithm to be specified. for the "OAEP" padding method, only the "SHA-1" and "SHA-256" hashing algorithms are supported. for all other padding methods this field is ignored, and may be absent. so if you're not on OAEP, she's just not listening 💀

the second section configures interaction with the PKCS #11 token repository. it contains this keyword: slot.

Example:

pkcs11 {
   slot = 0 }

the slot attribute must be an integer specifying the slot number to use. 🔢

💜 who's allowed to dip out 💜

of these attributes, the host, tls_client_cert, tls_client_key attributes of the kmip section and the slot attribute of the pkcs11 section may be absent from the file if they're specified by an environment variable or command option. they can ghost the config file, basically 🙈

the remaining attributes get treated as the default values shown in this example when they're absent. and the configuration file doesn't even need to be present at all if all the required attributes are specified by other means. oh and — attributes and groups may be specified in any order within the configuration file. she's flexible like that ✨

---

📝 Notes 📝

the pound sign ('#') is used to indicate a comment up to and including the end of line. so go off, annotate your config, live your truth 💅

---

👀 SEE ALSO 👀

• p11kmip(1)

---

and that's the whole page, bestie 🫶 this was version 3.27.0, dated August 2023, from the openCryptoki girlies. go configure something iconic ✨💖🎀