P11-KIT(8)

📦
version 0.26.5 · 15 versions
, in arch rolling, fedora 43, fedora 44

💅 p11-kit — the p11-kit(8) manual, bestie edition

okay so picture this: you're deep in System Commands territory and you've got a p11-kit situation. don't panic, i got you. this is the whole page, every flag, every path, no crumbs left behind. 🫶

✨ NAME ✨

p11-kit — the tool for doing stuff to your configured PKCS#11 modules. that's the whole vibe. 💖

🌈 SYNOPSIS 🌈

p11-kit list-modules

p11-kit list-tokens ...

p11-kit list-objects ...

p11-kit import-object ...

p11-kit export-object ...

p11-kit delete-object ...

p11-kit generate-keypair ...

p11-kit list-profiles ...

p11-kit add-profile ...

p11-kit delete-profile ...

p11-kit list-mechanisms ...

p11-kit print-config

p11-kit extract ...

p11-kit server ...

like. that's a lot of subcommands. main character energy fr fr. 👑

🦋 DESCRIPTION 🦋

p11-kit is a command line tool, and what it does is perform operations on the PKCS#11 modules that are configured on your system. that's it. that's the whole job. ✨

go look at all the sub commands down below — but first, real quick, here are the global options that work anywhere:

  • -v, --verbose — run in verbose mode, with debug output. it will NOT stop talking and honestly? sometimes you need that. 🗣️
  • -q, --quiet — run in quiet mode, without warning or failure messages. silence. peace. no notes. 🤫

🌸 LIST MODULES 🌸

lists the PKCS#11 modules that are configured on your system.

$ p11-kit list-modules

it'll show you the modules, info about them, and the tokens that are chillin' inside those PKCS#11 modules. full tour. 💅

🎀 LIST TOKENS 🎀

lists all the tokens available in the PKCS#11 modules that are configured on your system.

$ p11-kit list-tokens pkcs11:token

it grabs every token and shows off some of their common attributes. like a little token meet-and-greet.

this subcommand takes the following options:

  • --only-uris — print only the matching token URIs. nothing else, just the URIs, that's the rule. ✨
  • --provider=<module_path> — load only the given PKCS#11 module instead of enumerating all the modules installed on the system. and lowkey important: if module_path is a relative path, the module gets loaded from the default module path. you can find out what that path is by running:
$ pkg-config p11-kit-1 --variable p11_module_path
/usr/lib64/pkcs11

💜 LIST OBJECTS 💜

lists the objects that match a given PKCS#11 URI.

$ p11-kit list-objects pkcs11:object_on_token

it retrieves every object matching that PKCS#11 URI and shows some of their common attributes. and here's a cute detail: storage objects also get their PKCS#11 URI displayed. slay.

this subcommand takes the following options:

  • --login — authenticate to the token before enumerating objects. the PIN value gets read from either the pin-value attribute in the URI, or from the terminal. pick your fighter. 🔐
  • --provider=<module_path> — load only the given PKCS#11 module instead of enumerating all the modules installed on the system. if module_path is a relative path, the module is loaded from the default module path. find that path with:
$ pkg-config p11-kit-1 --variable p11_module_path
/usr/lib64/pkcs11

🍓 IMPORT OBJECT 🍓

imports an object into a PKCS#11 token.

$ p11-kit import-object --file=file.pem [--label=label] [--id=object_id] pkcs11:token

so what it does: it takes either an X.509 certificate or a public key (in the form of a PEM file) and imports it into the first token matched by the given PKCS#11 URI. first match wins, no cap.

the following options are required:

  • --file=<file.pem> — the file containing either an X.509 certificate or a public key, in PEM format. yeah you gotta have this one, it's not optional bestie.

this subcommand also accepts the following options:

  • --label=<label> — assigns label to the imported object. 🏷️
  • --id=<object_id> — assigns ID to the imported object. the ID should be specified in hexadecimal format without the 0x prefix. no 0x, we're serious.
  • --login — authenticate to the token before enumerating objects. the PIN value is read from either the pin-value attribute in the URI or from the terminal.
  • --provider=<module_path> — load only the given PKCS#11 module instead of enumerating modules installed on the system. if module_path is a relative path, the module is loaded from the default module path, which you can determine by running:
$ pkg-config p11-kit-1 --variable p11_module_path
/usr/lib64/pkcs11

🧚 EXPORT OBJECT 🧚

exports the object matching a PKCS#11 URI.

$ p11-kit export-object pkcs11:object_on_token

it displays the PEM formatted contents of the first object matched by the given PKCS#11 URI. and important caveat, so listen up: the matched object has to either be an X.509 certificate or a public key. anything else and it's not happening. 💀

this subcommand takes the following options:

  • --login — authenticate to the token before enumerating objects. the PIN value is read from either the pin-value attribute in the URI or from the terminal.
  • --provider=<module_path> — load only the given PKCS#11 module instead of enumerating modules installed on the system. if module_path is a relative path, the module is loaded from the default module path. you can determine that path by running:
$ pkg-config p11-kit-1 --variable p11_module_path
/usr/lib64/pkcs11

💀 DELETE OBJECT 💀

deletes the object matching a PKCS#11 URI.

$ p11-kit delete-object pkcs11:object_on_token
bestie. this one destroys the first object matched by the given PKCS#11 URI. gone. poof. no undo button. 🙈

this subcommand takes the following options:

  • --login — authenticate to the token before enumerating objects. the PIN value is read from either the pin-value attribute in the URI or from the terminal.
  • --provider=<module_path> — load only the given PKCS#11 module instead of enumerating modules installed on the system. if module_path is a relative path, the module is loaded from the default module path. figure out that path with:
$ pkg-config p11-kit-1 --variable p11_module_path
/usr/lib64/pkcs11

🔑 GENERATE KEY-PAIR 🔑

generates a key-pair on a PKCS#11 token. 💖✨

$ p11-kit generate-keypair --type=algorithm {--bits=n|--curve=name} [--label=label] [--id=object_id] pkcs11:token

it generates a private-public key-pair of the given type on the first token matched by the given PKCS#11 URI. and here's the tea: you should use this command together with the --type option and one of --bits or --curve. one. not both. we'll get there.

the following options are required:

  • --type=<algorithm> — specify the type of keys to generate. supported values are rsa, ecdsa and eddsa. pick one bestie. 🌈
  • --bits=<n> — specify the number of bits for the key-pair generation. cannot be used together with the --curve option. 🚫
  • --curve=<name> — specify an elliptic curve for the key-pair generation. supported values are secp256r1, secp384r1, secp521r1, ed25519 and ed448. cannot be used together with the --bits option. 🚫

this subcommand also accepts the following options:

  • --label=<label> — assigns label to the generated key-pair objects. 🏷️
  • --id=<object_id> — assigns ID to the generated key-pair objects. the ID should be specified in hexadecimal format without the 0x prefix. (again. NO 0x.)
  • --login — authenticate to the token before enumerating objects. the PIN value is read from either the pin-value attribute in the URI or from the terminal.
  • --provider=<module_path> — load only the given PKCS#11 module instead of enumerating modules installed on the system. if module_path is a relative path, the module is loaded from the default module path. determine that path by running:
$ pkg-config p11-kit-1 --variable p11_module_path
/usr/lib64/pkcs11

👑 LIST PROFILES 👑

lists the PKCS#11 profiles supported by the token.

$ p11-kit list-profiles pkcs11:token

it displays the profile IDs of the first token matched by the given PKCS#11 URI, in human-readable form. so you can actually read them. iconic.

this subcommand takes the following options:

  • --login — authenticate to the token before enumerating objects. the PIN value is read from either the pin-value attribute in the URI or from the terminal.
  • --provider=<module_path> — load only the given PKCS#11 module instead of enumerating modules installed on the system. if module_path is a relative path, the module is loaded from the default module path. get that path with:
$ pkg-config p11-kit-1 --variable p11_module_path
/usr/lib64/pkcs11

⭐ ADD PROFILE ⭐

adds a PKCS#11 profile to a token.

$ p11-kit add-profile --profile=profile pkcs11:token

it creates a new profile object with the given profile ID on the first token matched by the given PKCS#11 URI. and heads up: this command fails if the profile ID already exists on the token. no duplicates allowed, periodt. 💅

the following options are required:

  • --profile=<profile> — the profile ID to add. the value can either be numerical or textual. your call.

this subcommand also accepts the following options:

  • --login — authenticate to the token before enumerating objects. the PIN value is read from either the pin-value attribute in the URI or from the terminal.
  • --provider=<module_path> — load only the given PKCS#11 module instead of enumerating modules installed on the system. if module_path is a relative path, the module is loaded from the default module path. you can determine this path by running:
$ pkg-config p11-kit-1 --variable p11_module_path
/usr/lib64/pkcs11

🎀 DELETE PROFILE 🎀

deletes a PKCS#11 profile from a token.

$ p11-kit delete-profile --profile=profile pkcs11:token

it destroys all profile objects with the given profile ID from the first token matched by the given PKCS#11 URI. all of them. not one. all. 😭

the following options are required:

  • --profile=<profile> — the profile ID to delete. the value can either be numerical or textual.

this subcommand also accepts the following options:

  • --login — authenticate to the token before enumerating objects. the PIN value is read from either the pin-value attribute in the URI or from the terminal.
  • --provider=<module_path> — load only the given PKCS#11 module instead of enumerating modules installed on the system. if module_path is a relative path, the module is loaded from the default module path. figure it out with:
$ pkg-config p11-kit-1 --variable p11_module_path
/usr/lib64/pkcs11

🔥 LIST MECHANISMS 🔥

lists the PKCS#11 mechanisms supported by the token.

$ p11-kit list-mechanisms pkcs11:token

this lists all available mechanimsms for a PKCS#11 token. (yes, "mechanimsms". the original said it like that and honestly? i respect it. it's giving typo chic. 💅 we keep it exactly as-is because the facts don't change around here.)

prints the merged configuration.

$ p11-kit print-config

okay so here's the lore: p11-kit provides 3 levels of configuration — system wide, per-module, and per-user. and at run-time, all 3 levels get merged into a single configuration. this command displays that merged configuration. so it's like the group chat where everyone's messages get combined into one chaotic beautiful thread. 🫶

🦋 EXTRACT 🦋

extracts certificates from configured PKCS#11 modules.

🚨 okay so this operation has been moved to a separate command: trust extract. see trust(1) for more information. so if you came here looking for extract, go follow the breadcrumbs bestie. ✨

✨ SERVER ✨

Okay bestie, this one is giving main character energy — it literally runs a whole server process that exposes a PKCS#11 module remotely. 💅

$ p11-kit server pkcs11:token1 pkcs11:token2 ...
$ p11-kit server --provider /path/to/pkcs11-module.so pkcs11:token1 pkcs11:token2 ...

So what it does: it launches a server that exposes the PKCS#11 tokens you named on a local socket. 🫶

Heads up: the tokens must belong to the same module. Like, non-negotiable, they're a package deal. 😭

To actually access that socket, you use the p11-kit-client.so module. That's the whole vibe.

And here's the cute part — the server address and PID get printed out as a shell-script snippet that sets the appropriate environment variable, specifically:

  • P11_KIT_SERVER_ADDRESS
  • P11_KIT_SERVER_PID

So you can just source it and go, no cap. ✨

🦋 EXTRACT TRUST 🦋

Extract standard trust information files. 🎀

Plot twist: this operation has been moved to a separate command, trust extract-compat. See trust(1) for more info. It's not living here anymore, it moved out and got its own place. 🏠

💜 REMOTE 💜

Run a PKCS#11 module remotely. Remote queen behavior, honestly.

$ p11-kit remote /path/to/pkcs11-module.so
$ p11-kit remote pkcs11:token1 pkcs11:token2 ...

Okay so real talk — this is not meant to be run directly from a terminal. It's meant to go in a remote option in a pkcs11.conf(5) file. That's its natural habitat. 🧚

What it does: it exposes the given PKCS#11 module or tokens over standard input and standard output.

Those two forms — exposing a module, or exposing tokens — are mutually exclusive. Pick one, bestie, you can't have both. 🙈 And if you go with the second form, the tokens must belong to the same module. Same rule as always, iconic consistency. 👑

💀 BUGS 💀

Found a bug? Please send bug reports to either the distribution bug tracker or the upstream bug tracker at:

https://github.com/p11-glue/p11-kit/issues/

They wanna hear from you, fr fr. 🍓

🌈 SEE ALSO 🌈

Further details available in the p11-kit online documentation at:

https://p11-glue.github.io/p11-glue/p11-kit/manual/

And that's a wrap on the whole page, babe! 🎀 This one's from p11-kit itself, living in section P11-KIT(8) — go forth and configure your PKCS#11 stuff with confidence. You ate this. 💅✨🫶

📦 where this page comes from