p11tool - GnuTLS PKCS #11 tool Usage: p11tool [ - [] | --[{=| }] ]... [url] None: Tokens: --list-tokens List all available tokens --list-token-urls List the URLs available tokens --list-mechanisms List all available mechanisms in a token --initialize Initializes a PKCS #11 token --initialize-pin Initializes/Resets a PKCS #11 token user PIN --initialize-so-pin Initializes/Resets a PKCS #11 token security officer PIN --set-pin=str Specify the PIN to use on token operations --set-so-pin=str Specify the Security Officer's PIN to use on token initialization Object listing: --list-all List all available objects in a token --list-all-certs List all available certificates in a token --list-certs List all certificates that have an associated private key --list-all-privkeys List all available private keys in a token --list-privkeys an alias for the 'list-all-privkeys' option --list-keys an alias for the 'list-all-privkeys' option --list-all-trusted List all available certificates marked as trusted --export Export the object specified by the URL - prohibits these options: export-stapled export-chain export-pubkey --export-stapled Export the certificate object specified by the URL - prohibits these options: export export-chain export-pubkey --export-chain Export the certificate specified by the URL and its chain of trust - prohibits these options: export-stapled export export-pubkey --export-pubkey Export the public key for a private key - prohibits these options: export-stapled export export-chain --info List information on an available object in a token --trusted an alias for the 'mark-trusted' option --distrusted an alias for the 'mark-distrusted' option Key generation: --generate-privkey=str Generate private-public key pair of given type --bits=num Specify the number of bits for the key generate --curve=str Specify the curve used for EC key generation --sec-param=str Specify the security level Writing objects: --set-id=str Set the CKA_ID (in hex) for the specified by the URL object - prohibits the option 'write' --set-label=str Set the CKA_LABEL for the specified by the URL object - prohibits these options: write set-id --write Writes the loaded objects to a PKCS #11 token --delete Deletes the objects matching the given PKCS #11 URL --label=str Sets a label for the write operation --id=str Sets an ID for the write operation --mark-wrap Marks the generated key to be a wrapping key --mark-trusted Marks the object to be written as trusted - prohibits the option 'mark-distrusted' --mark-distrusted When retrieving objects, it requires the objects to be distrusted - prohibits the option 'mark-trusted' --mark-decrypt Marks the object to be written for decryption --mark-sign Marks the object to be written for signature generation --mark-ca Marks the object to be written as a CA --mark-private Marks the object to be written as private --ca an alias for the 'mark-ca' option --private an alias for the 'mark-private' option --mark-always-authenticate Marks the object to be written as always authenticate --secret-key=str Provide a hex encoded secret key --load-privkey=file Private key file to use - file must pre-exist --load-pubkey=file Public key file to use - file must pre-exist --load-certificate=file Certificate file to use - file must pre-exist Other options: -d, --debug=num Enable debugging - it must be in the range: 0 to 9999 --outfile=str Output file --login Force (user) login to token --so-login Force security officer login to token --admin-login an alias for the 'so-login' option --test-sign Tests the signature operation of the provided object --sign-params=str Sign with a specific signature algorithm --hash=str Hash algorithm to use for signing --generate-random=num Generate random data -8, --pkcs8 Use PKCS #8 format for private keys --inder Use DER/RAW format for input --inraw an alias for the 'inder' option --outder Use DER format for output certificates, private keys, and DH parameters --outraw an alias for the 'outder' option --provider=file Specify the PKCS #11 provider library --detailed-url Print detailed URLs --only-urls Print a compact listing using only the URLs --batch Disable all interaction with the tool Version, usage and configuration options: -v, --version[=arg] output version information and exit -h, --help display extended usage information and exit -!, --more-help extended usage information passed thru pager Options are specified by doubled hyphens and their name or by a single hyphen and the flag character. Operands and options may be intermixed. They will be reordered. Program that allows operations on PKCS #11 smart cards and security modules. To use PKCS #11 tokens with GnuTLS the p11-kit configuration files need to be setup. That is create a .module file in /etc/pkcs11/modules with the contents 'module: /path/to/pkcs11.so'. Alternatively the configuration file /etc/gnutls/pkcs11.conf has to exist and contain a number of lines of the form 'load=/usr/lib/opensc-pkcs11.so'. You can provide the PIN to be used for the PKCS #11 operations with the environment variables GNUTLS_PIN and GNUTLS_SO_PIN. Please send bug reports to: