| P11-KIT(8) | System Commands | P11-KIT(8) |
NAME¶
p11-kit - Tool for operating on configured PKCS#11 modules
SYNOPSIS¶
p11-kit list-modules
p11-kit list-tokens ...
p11-kit list-objects ...
p11-kit import-object ...
p11-kit export-object ...
p11-kit delete-object ...
p11-kit generate-keypair ...
p11-kit list-profiles ...
p11-kit add-profile ...
p11-kit delete-profile ...
p11-kit list-mechanisms ...
p11-kit print-config
p11-kit extract ...
p11-kit server ...
DESCRIPTION¶
p11-kit is a command line tool that can be used to perform operations on PKCS#11 modules configured on the system.
See the various sub commands below. The following global options can be used:
-v, --verbose
-q, --quiet
LIST MODULES¶
List system configured PKCS#11 modules.
$ p11-kit list-modules
The modules, information about them and the tokens present in the PKCS#11 modules will be displayed.
LIST TOKENS¶
List all tokens available in system configured PKCS#11 modules.
$ p11-kit list-tokens [--only-uris] pkcs11:token
This retrieves all tokens and displays some of their common attributes. If --only-uris is given, only the matching token URIs are printed.
LIST OBJECTS¶
List objects matching given PKCS#11 URI.
$ p11-kit list-objects [--login] pkcs11:object_on_token
This retrieves all objects that match given PKCS#11 URI and displays some of their common attributes. Storage objects also have their PKCS#11 URI displayed.
IMPORT OBJECT¶
Import object into PKCS#11 token.
$ p11-kit import-object --file=file.pem [--label=label] [--login] pkcs11:token
Takes either an X.509 certificate or a public key in the form of a PEM file and imports it into the first token matched by given PKCS#11 URI.
--file=<file.pem>
--label=<label>
EXPORT OBJECT¶
Export object matching PKCS#11 URI.
$ p11-kit export-object [--login] pkcs11:object_on_token
Displays PEM formatted contents of the first object matched by given PKCS#11 URI. The matched object has to either be an X.509 certificate or a public key.
DELETE OBJECT¶
Delete object matching PKCS#11 URI.
$ p11-kit delete-object [--login] pkcs11:object_on_token
Destroys the first object matched by given PKCS#11 URI.
GENERATE KEY-PAIR¶
Generate key-pair on a PKCS#11 token.
$ p11-kit generate-keypair --type=algorithm {--bits=n|--curve=name} [--label=label] [--login] pkcs11:token
Generate private-public key-pair of given type on the first token matched by given PKCS#11 URI. This command should be used together with --type option and one of --bits or --curve options.
--type=<algorithm>
--bits=<n>
--curve=<name>
--label=<label>
LIST PROFILES¶
List PKCS#11 profiles supported by the token.
$ p11-kit list-profiles [--login] pkcs11:token
Displays profile IDs of the first token matched by given PKCS#11 URI in human-readable form.
ADD PROFILE¶
Add PKCS#11 profile to a token.
$ p11-kit add-profile --profile=profile [--login] pkcs11:token
Creates new profile object with given profile ID on the first token matched by given PKCS#11 URI. This command fails if the profile ID already exists on the token.
--profile=<profile>
DELETE PROFILE¶
Delete PKCS#11 profile from a token.
$ p11-kit delete-profile --profile=profile [--login] pkcs11:token
Destroys all profile objects with given profile ID from the first token matched by given PKCS#11 URI.
--profile=<profile>
LIST MECHANISMS¶
List PKCS#11 mechanisms supported by the token.
$ p11-kit list-mechanisms pkcs11:token
This lists all available mechanimsms for a PKCS#11 token
PRINT CONFIG¶
Print merged configuration.
$ p11-kit print-config
P11-kit provides 3 levels of configuration: system wide, per-module, and per-user. At run-time all 3 levels are merged into a single configuration. This command displays the merged configuration.
EXTRACT¶
Extract certificates from configured PKCS#11 modules.
This operation has been moved to a separate command trust extract. See trust(1) for more information
SERVER¶
Run a server process that exposes PKCS#11 module remotely.
$ p11-kit server pkcs11:token1 pkcs11:token2 ... $ p11-kit server --provider /path/to/pkcs11-module.so pkcs11:token1 pkcs11:token2 ...
This launches a server that exposes the given PKCS#11 tokens on a local socket. The tokens must belong to the same module. To access the socket, use p11-kit-client.so module. The server address and PID are printed as a shell-script snippet which sets the appropriate environment variable: P11_KIT_SERVER_ADDRESS and P11_KIT_SERVER_PID.
EXTRACT TRUST¶
Extract standard trust information files.
This operation has been moved to a separate command trust extract-compat. See trust(1) for more information
REMOTE¶
Run a PKCS#11 module remotely.
$ p11-kit remote /path/to/pkcs11-module.so $ p11-kit remote pkcs11:token1 pkcs11:token2 ...
This is not meant to be run directly from a terminal. But rather in a remote option in a pkcs11.conf(5) file.
This exposes the given PKCS#11 module or tokens over standard input and output. Those two forms, whether to expose a module or tokens, are mutually exclusive and if the second form is used, the tokens must belong to the same module.
BUGS¶
Please send bug reports to either the distribution bug tracker or the upstream bug tracker at https://github.com/p11-glue/p11-kit/issues/.
SEE ALSO¶
Further details available in the p11-kit online documentation at https://p11-glue.github.io/p11-glue/p11-kit/manual/.
| p11-kit |