P11TOOL(1) P11TOOL(1) (NAME) p11tool - PKCS #11 GnuTLS (SYNOPSIS) p11tool [ ] [ _PKCS11 ] . (DESCRIPTION) p11tool PKCS #11 GnuTLS . PKCS #11 GnuTLS p11-kit . .module /etc/pkcs11/modules 'module: /path/to/pkcs11.so' . /etc/gnutls/pkcs11.conf 'load=/usr/lib/opensc-pkcs11.so' . (PIN) PKCS #11 GNUTLS_PIN GNUTLS_SO_PIN . (OPTIONS) (Tokens) --list-tokens . --list-token-urls (URL) . --list-tokens . --list-mechanisms (mechanisms) . --initialize PKCS #11. --initialize-pin (PIN) PKCS #11. --initialize-so-pin (Security Officer / SO) PKCS #11. . GNUTLS_NEW_SO_PIN . --set-pin= . GNUTLS_PIN . --set-so-pin= . GNUTLS_SO_PIN . (Object listing) --list-all . . --list-all-certs . ( p11-kit-trust) . --list-certs . ( ID ). --list-all-privkeys . (URL) . --list-privkeys --list-all-privkeys . --list-keys --list-all-privkeys . --list-all-trusted . --export URL. : export-stapled export-chain export-pubkey. --export-stapled URL. : export export-chain export-pubkey. . p11-kit p11-kit . --export-chain URL . : export-stapled export export-pubkey. . --export-pubkey . : export-stapled export export-chain. . --info . --trusted --mark-trusted . --distrusted --mark-distrusted . (Key generation) --generate-privkey= - . - . RSA ECDSA Ed25519 DSA. --sec-param --bits . --generate-rsa - RSA. - RSA . --sec-param --bits . : . --generate-dsa - DSA. - DSA . --sec-param --bits . : . --generate-ecc - ECDSA. - ECDSA . --curve --sec-param --bits . : . --bits= . . --sec-param sec-param gnutls . --curve= EC. secp192r1 secp224r1 secp256r1 secp384r1 secp521r1. --sec-param=_ . bits . [low, legacy, medium, high, ultra]. (Writing objects) --set-id= CKA_ID ( ) URL. write . CKA_ID URL . '0x' . --set-label= CKA_LABEL URL. write set-id . CKA_LABEL URL . --write PKCS #11. . --load-privkey --load-pubkey --load-certificate . CKA_ID CKA_ID ( ) (Subject Key Identifier) X.509 . . --delete PKCS #11 . --label= . --id= (ID) . CKA_ID . '0x' . --mark-wrap, --no-mark-wrap (wrapping key). no-mark-wrap . CKA_WRAP . --mark-trusted, --no-mark-trusted (trusted). mark-distrusted . no-mark-trusted . / CKA_TRUST . --mark-distrusted (distrusted) . mark-trusted . CKA_X_TRUST . p11-kit p11-kit . --mark-decrypt, --no-mark-decrypt . no-mark-decrypt . / CKA_DECRYPT true . --mark-sign, --no-mark-sign . no-mark-sign . / CKA_SIGN true . --mark-ca, --no-mark-ca (CA). no-mark-ca . / CKA_CERTIFICATE_CATEGORY CA . --mark-private, --no-mark-private (). no-mark-private . / CKA_PRIVATE . (PIN) . --ca --mark-ca . --private --mark-private . --mark-always-authenticate, --no-mark-always-authenticate . no-mark-always-authenticate . / CKA_ALWAYS_AUTHENTICATE . ( ) . --secret-key= . --write . --load-privkey= . --load-pubkey= . --load-certificate= . (Other options) -d , --debug= . . 0 9999 . . --outfile= . --login, --no-login () . no-login . --so-login, --no-so-login . no-so-login . () . --admin-login --so-login . --test-sign . . . --sign-params= . --test-sign . 'RSA-PSS' RSA-PSS RSA . --hash= () . test-sign . SHA1 RMD160 SHA256 SHA384 SHA512 SHA3-224 SHA3-256 SHA3-384 SHA3-512. --generate-random= . . . -8, --pkcs8 PKCS #8 . --inder, --no-inder DER/RAW . no-inder . DER/RAW . --inraw --inder . --outder, --no-outder DER DH . no-outder . DER RAW . --outraw --outder . --provider= PKCS #11. /etc/gnutls/pkcs11.conf . --provider-opts= PKCS #11. PKCS #11 PKCS #11 . : . --detailed-url, --no-detailed-url . no-detailed-url . --only-urls (URLs). --batch . (batch) . -v , --version= . `v` . `c` `n` . -h, --help . -!, --more-help (pager). (EXAMPLES) : $ p11tool --list-tokens : $ p11tool --login --list-all "pkcs11:TOKEN-URL" : $ p11tool --login --write "pkcs11:URL" --load-privkey key.pem \ --label "Mykey" $ p11tool --login --write "pkcs11:URL" --load-certificate cert.pem \ --label "Mykey" (label) . RSA : $ p11tool --login --generate-privkey rsa --bits 1024 --label "MyNewKey" \ --outfile MyNewKey.pub "pkcs11:TOKEN-URL" bits . . certtool : certtool --generate-request --load-privkey "pkcs11:KEY-URL" \ --load-pubkey MyNewKey.pub --outfile request.pem (EXIT STATUS) : 0 " (EXIT_SUCCESS)" . 1 " (EXIT_FAILURE)" . (SEE ALSO) certtool(1) (AUTHORS) GnuTLS . (COPYRIGHT) (C) 2020-2023 (Free Software Foundation) . (GNU GPL) . (BUGS) : bugs@gnutls.org gnutls P11TOOL(1)