softhsm2.conf(5)

📦
version 2.7.0 · 5 versions
, in alpine 3.24, arch rolling, fedora 44

✨ softhsm2.conf ✨ — the SoftHSM config file, bestie edition

okay so this is the manual page for softhsm2.conf(5), from the File Formats Manual section. it's the config file for SoftHSM and honestly? it's giving "small file, big power." let's get into it 💅

🎀 NAME 🎀

softhsm2.conf — the SoftHSM configuration file. that's it, that's the name, iconic.

🦋 SYNOPSIS 🦋

softhsm2.conf

🌸 DESCRIPTION 🌸

so this is the configuration file for SoftHSM. it lives in a default location (we'll get to that in FILES, don't worry bestie) but you can also relocate it by using the environment variable. and listen — any configuration you do has to follow the file format found in this document. no freestyling. the format is the format. periodt.

💖 FILE FORMAT 💖

every configuration option is a pair of a name and a value, separated by an equality sign. and the whole option has to sit on a single line. one line, no splitting, we're not doing multi-line drama here:

<name> = <value>

you can also add comments in the file using the hash sign. anything after the hash sign gets ignored. it's like whispering into the void and the void is like "noted, moving on":

# A comment

and any empty lines, or lines that don't have the correct format? ignored. bye. not read. they simply did not pass the vibe check. 😭

🔥 DIRECTORIES.TOKENDIR 🔥

the location where SoftHSM can store the tokens. this is the one that actually matters, lowkey.

directories.tokendir = /var/lib/softhsm/tokens/

👑 OBJECTSTORE.BACKEND 👑

the backend SoftHSM uses to store token objects. either "file" or "db" is supported — those are your two options, pick one. but here's the tea: in order to use the "db" backend, the SoftHSM build needs to be configured with configure --with-objectstore-backend-db. so if your build wasn't built with that flag, that backend is not for you, sorry bestie 🫶

objectstore.backend = file

🧚 OBJECTSTORE.UMASK 🧚

the file mode creation mask used by SoftHSM when creating files or directories. this value is in octal, so watch your digits. also — and this is important — this is applied in addition to the process umask and it cannot override it. you can't beat the process umask at its own game. it's the main character here, yours is just a supporting role.

objectstore.umask = 0077

🌈 LOG.LEVEL 🌈

the log level, which can be set to ERROR, WARNING, INFO or DEBUG. four options, that's the whole menu, choose your level of chaos. 💀

log.level = INFO

⭐ SLOTS.REMOVABLE ⭐

if set to true, CKF_REMOVABLE_DEVICE is set in the flags returned by C_GetSlotInfo. default is false. so if you want the removable-device flag, you gotta ask for it.

slots.removable = true

💜 SLOTS.MECHANISMS 💜

this one lets you enable and disable any of the PKCS#11 mechanisms reported in the C_GetMechanismList(). the option accepts a string argument containing the comma separated list of all algorithms that should be enabled — and ngl, do not forget about the keygen mechanisms, bestie, that's the classic oopsie. 🥲

the list can be prefixed with a minus sign "-" to list only the disabled mechanisms. and additionally, there's a special keyword ALL you can use to enable all the known mechanisms — that's the default btw. unknown mechanisms are ignored, they just get filtered out of the group chat. ✨

oh and heads up: this option has higher priority than the CKA_ALLOWED_MECHANISMS attribute on the key objects. so this config file is the one calling the shots here. periodt.

slots.mechanisms = ALL

🫶 LIBRARY.RESET_ON_FORK 🫶

if set to true, the library will reset the state on fork. default is false.

library.reset_on_fork = true

🌟 ENVIRONMENT 🌟

  • SOFTHSM2_CONF — when defined, the value will be used as the path to the configuration file. so like, you point, it goes. iconic behaviour honestly.

🍓 FILES 🍓

  • ~/.config/softhsm2/softhsm2.conf — the default user-specific location of the SoftHSM configuration file; if it exists it will override the system wide configuration. yes, it does say that. the user file wins. main character energy, fr fr. 👑
  • /etc/softhsm2.conf — the default system-wide location of the SoftHSM configuration file.
  • /etc/softhsm2.conf.sample — an example of a SoftHSM configuration file. it's like the blueprint, the inspo board, the mood board for your config. 🎀

💅 AUTHOR 💅

Written by Rickard Bellgrim, Francis Dupont, René Post, and Roland van Rijswijk. absolute legends, every single one. 🫶

🔗 SEE ALSO 🔗

softhsm2-keyconv(1), softhsm2-migrate(1), softhsm2-util(1)

and that's the whole page bestie, no cap, every single flag accounted for 💖

SoftHSM — 30 October 2014 🌸 that's the source and the date, and this has been softhsm2.conf(5). go configure something gorgeous. mwah 💋✨

📦 where this page comes from