p11tool — GnuTLS PKCS #11 tool
p11tool [ −flag [value] ...] [ −−opt−name [[=|]value] ...] [url]
Program that allows handling data from PKCS #11 smart cards and security modules. To use PKCS #11 tokens with gnutls the configuration file /etc/gnutls/pkcs11.conf has to exist and contain a number of lines of the form 'load=/usr/lib/opensc-pkcs11.so'.
−d
number,
−−debug=numberEnable debugging.. This option takes an integer number as its argument. The value of number is constrained to being:
in the range 0 through 9999
Specifies the debug level.
−−outfile=stringOutput file.
−−list−tokensList all available tokens.
−−exportExport the object specified by the URL.
−−list−mechanismsList all available mechanisms in a token.
−−list−allList all available objects in a token.
−−list−all−certsList all available certificates in a token.
−−list−certsList all certificates that have an associated private key.
−−list−all−privkeysList all available private keys in a token.
−−list−all−trustedList all available certificates marked as trusted.
−−initializeInitializes a PKCS #11 token.
−−writeWrites the loaded objects to a PKCS #11 token.
It can be used to write private keys, certificates or secret keys to a token.
−−deleteDeletes the objects matching the PKCS #11 URL.
−−generate−rsaGenerate an RSA private-public key pair.
Generates an RSA private-public key pair on the specified token.
−−generate−dsaGenerate an RSA private-public key pair.
Generates an RSA private-public key pair on the specified token.
−−generate−eccGenerate an RSA private-public key pair.
Generates an RSA private-public key pair on the specified token.
−−label=stringSets a label for the write operation.
−−trusted, −−no−trustedMarks the object to be written as trusted. The
no−trusted form
will disable the option.
−−private, −−no−privateMarks the object to be written as private. The
no−private form
will disable the option. This option is enabled by
default.
The written object will require a PIN to be used.
−−login, −−no−loginForce login to token. The no−login form
will disable the option.
−−detailed−url, −−no−detailed−urlPrint detailed URLs. The no−detailed−url
form will disable the option.
−−secret−key=stringProvide a hex encoded secret key.
−−load−privkey=filePrivate key file to use.
−−load−pubkey=filePublic key file to use.
−−load−certificate=fileCertificate file to use.
Use PKCS #8 format for private keys.
−−bits=numberSpecify the number of bits for key generate. This option takes an integer number as its argument.
−−sec−param=security
parameterSpecify the security level.
This is alternative to the bits option. Available options are [low, legacy, normal, high, ultra].
−−inder, −−no−inderUse DER/RAW format for input. The no−inder form
will disable the option.
Use DER/RAW format for input certificates and private keys.
−−inderThis is an alias for the inder option.
−−provider=fileSpecify the PKCS #11 provider library.
This will override the default options in /etc/gnutls/pkcs11.conf
−h,
−−helpDisplay usage information and exit.
−!,
−−more−helpPass the extended usage information through a pager.
−v
[{v|c|n}],
−−version[={v|c|n}]Output version of program and exit. The default mode is `v', a simple version. The `c' mode will print copyright information and `n' will print the full copyright notice.
To view all tokens in your system use:
$ p11tool −−list−tokens
To view all objects in a token use:
$ p11tool −−login −−list−all "pkcs11:TOKEN−URL"
To store a private key and a certificate in a token run:
$ p11tool −−login −−write "pkcs11:URL" −−load−privkey key.pem −−label "Mykey" $ p11tool −−login −−write "pkcs11:URL" −−load−certificate cert.pem −−label "Mykey"
Note that some tokens require the same label to be used for the certificate and its corresponding private key.
One of the following exit values will be returned:
0
(EXIT_SUCCESS)Successful program execution.
1
(EXIT_FAILURE)The operation failed or the command syntax was not valid.