pki-tps-connector(5)

💖 pki-tps-connector(5) — PKI TPS Profile Configuration 💖

okay bestie, gather round, because this is the page for pki-tps-connector(5), aka the PKI TPS Profile Configuration manual. it's literally all about how token profiles get defined, and once you get the vibe it's so slay. no cap, every property here is just a little key=value moment living inside a config file. let's get into it 🫶

---

📍 LOCATION

/var/lib/pki/instance/conf/tps/CS.cfg

that's the file. that's the one. everything below lives in there. periodt. 💅

---

✨ DESCRIPTION ✨

so the whole concept: token profiles are defined using properties in the TPS configuration file. that's the tea. each section below is a different operation, and each one has its own lil properties. let's go one by one, no skipping, we don't do that here 💖

🎀 Enrollment Operation For CoolKey 🎀

first up, enrollment. this next property sets the size of the key the token should generate:

op.enroll.<tokenType>.keyGen.<keyType>.keySize=1024

heads up: the maximum value is 1024. so don't get cute and go bigger, bestie.

now the properties that specify the PKCS11 attributes to set on the token. there are a whole dozen of these and yes, we are listing all of them, because they're all iconic in their own way:

op.enroll.<tokenType>.keyGen.<keyType>.keyCapabilities.encrypt=false
op.enroll.<tokenType>.keyGen.<keyType>.keyCapabilities.sign=true
op.enroll.<tokenType>.keyGen.<keyType>.keyCapabilities.signRecover=true
op.enroll.<tokenType>.keyGen.<keyType>.keyCapabilities.decrypt=false
op.enroll.<tokenType>.keyGen.<keyType>.keyCapabilities.derive=false
op.enroll.<tokenType>.keyGen.<keyType>.keyCapabilities.unwrap=false
op.enroll.<tokenType>.keyGen.<keyType>.keyCapabilities.wrap=false
op.enroll.<tokenType>.keyGen.<keyType>.keyCapabilities.verifyRecover=true
op.enroll.<tokenType>.keyGen.<keyType>.keyCapabilities.verify=true
op.enroll.<tokenType>.keyGen.<keyType>.keyCapabilities.sensitive=true
op.enroll.<tokenType>.keyGen.<keyType>.keyCapabilities.private=true
op.enroll.<tokenType>.keyGen.<keyType>.keyCapabilities.token=true

next, the property that specifies the CUID shown in the certificate:

op.enroll.<tokenType>.keyGen.<keyType>.cuid_label

and the property that specifies the token name:

op.enroll.<tokenType>.keyGen.<keyType>.label

now this part is lowkey my favorite because you get to use variables in the token name. here's the whole squad 🌈:

• $pretty_cuid$ — Pretty Print CUID (i.e. 4090-0062-FF02-0000-0B9C)
• $cuid$ — CUID (i.e. 40900062FF0200000B9C)
• $msn$ — MSN
• $userid$ — User ID
• $profileId$ — Profile ID

important, fr fr: all resulting labels for co-existing keys on the same token must be unique. no duplicates, bestie, we don't do that.

next up, the property that determines whether TPS will overwrite key and certificate if they already exist:

op.enroll.<tokenType>.keyGen.<keyType>.overwrite=true|false

now the properties that specify name PKCS11 object IDs:

op.enroll.<tokenType>.keyGen.<keyType>.certId=C1
op.enroll.<tokenType>.keyGen.<keyType>.certAttrId=c1
op.enroll.<tokenType>.keyGen.<keyType>.privateKeyAttrId=k2
op.enroll.<tokenType>.keyGen.<keyType>.publicKeyAttrId=k3
op.enroll.<tokenType>.keyGen.<keyType>.privateKeyNumber=2
op.enroll.<tokenType>.keyGen.<keyType>.publicKeyNumber=3

okay so here's the cipher, and honestly it's giving secret code 🕵️ — lower case letters signify objects containing PKCS11 object attributes in the format described below:

• c — an object containing PKCS11 attributes for a certificate.
• k — an object containing PKCS11 attributes for a public or private key.
• r — an object containing PKCS11 attributes for an "reader".

and upper case letters signify objects containing raw data corresponding to the lower case letters described above. for example, object C0 contains raw data corresponding to object c0. the way that's so consistent of them ✨

• C — this object contains an entire DER cert, and nothing else.
• K — this object contains a MUSCLE "key blob". TPS does not use this.

moving on! the following properties specify the algorithm, the key size, the key usage, and which PIN user should be granted:

op.enroll.<tokenType>.keyGen.<keyType>.alg=2
op.enroll.<tokenType>.keyGen.<keyType>.keySize=1024
op.enroll.<tokenType>.keyGen.<keyType>.keyUsage=0
op.enroll.<tokenType>.keyGen.<keyType>.keyUser=0

the valid algorithms are, and yes we love a short list:

• 2 — RSA
• 5 — ECC

for ECC, the valid key sizes are 256 and 384. 🌸

use privilege of the generated private key, or 15 if all users have use privilege for the private key. valid usages (and note this only specifies the usage for the private key, so don't get it twisted):

• 0 — default usage (Signing only for this APDU)
• 1 — signing only
• 2 — decryption only
• 3 — signing and decryption

next, the property that determines whether to enable writing of PKCS11 cache object to the token:

op.enroll.<tokenType>.pkcs11obj.enable=true|false

and the property that determines whether to enable compression for writing of PKCS11 cache object to the token:

op.enroll.<tokenType>.pkcs11obj.compress.enable=true|false

now the property that determines the maximum number of retries before blocking the token:

op.enroll.<tokenType>.pinReset.pin.maxRetries=127

again with the cap: the maximum value is 127.

there's a special case of tokenType userKeyTemporary. make sure the profile specified by the profileId has a short validity period (e.g. 7 days) for the certificate. short and sweet, main character energy 👑

op.enroll.userKey.keyGen.<keyType>.publisherId=fileBasedPublisher
op.enroll.userKeyTemporary.keyGen.<keyType>.publisherId=fileBasedPublisher

and this next property describes the scheme used for recovery:

op.enroll.<tokenType>.keyGen.<keyType>.recovery.<tokenState>.scheme=GenerateNewKey

the three recovery schemes supported are:

• GenerateNewKey — Generate a new cert for the encryption cert.
• RecoverLast — Recover the most recent cert for the encryption cert.
• GenerateNewKeyandRecoverLast — Generate new cert AND recover last for encryption cert.

pick your fighter, they're all valid 💖

🦋 Token Renewal 🦋

the following properties are used to define token renewal:

op.enroll.<tokenType>.renewal.*

for each token in the TPS UI, set the following to trigger renewal operations:

RENEW=YES

note this one: optional grace period enforcement must coincide exactly with what the CA enforces. no vibes-based guessing here, bestie.

in case of renewal, encryption certId values are for completeness only — server code calculates actual values used. so don't stress about them, they're just there to look pretty 🙈

🌈 Format Operation For tokenKey 🌈

the following property determines whether to update applet if the token is empty:

op.format.<tokenType>.update.applet.emptyToken.enable=false

this property is applicable to:

• CoolKey
• HouseKey
• HouseKey with Legacy Applet

🎀 Certificate Chain Imports 🎀

op.enroll.certificates.num=1
op.enroll.certificates.value.0=caCert
op.enroll.certificates.caCert.nickName=caCert0 pki-tps
op.enroll.certificates.caCert.certId=C5
op.enroll.certificates.caCert.certAttrId=c5
op.enroll.certificates.caCert.label=caCert Label

look at that chain, it's literally a chain. so meta. 🔥

💅 Pin Reset Operation For CoolKey 💅

the following property determines whether to update applet if the token is empty:

op.pinReset.<tokenType>.update.applet.emptyToken.enable=false

and unlike the format one up there, this property is not applicable to:

• HouseKey
• HouseKey with Legacy Applet

so close but not the same, iykyk 💀

---

👀 SEE ALSO

• pki-tps-profile(1)

go read that one next bestie, it's the sequel 🫶

---

💜 AUTHORS

Dogtag PKI Team <devel@lists.dogtagpki.org>.

📜 COPYRIGHT

Copyright (c) 2014 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.

---

and that's the whole page, bestie!! 🎉 this was the PKI manual, dated May 6, 2014, and you just read the pki-tps-connector(5) glow-up. go forth and configure those tokens, you absolute icon 👑✨💖