softhsm.conf(5) File Formats Manual softhsm.conf(5)NAME
softhsm.conf - SoftHSM configuration file
SYNOPSIS
softhsm.conf
DESCRIPTION
In PKCS#11 you need tokens in order to do cryptographic operations. Tokens can be viewed as object stores where you can store e.g. private
and public keys. A token must then be attached to a slot so that you can use it.
Slots and tokens are handled by the SoftHSM configuration file. The given paths in the configuration file are just an indication to
SoftHSM on where it should store the information for each token. The token databases will be created when the tokens gets initialized.
FILE FORMAT
Each pair of slot and token are configured on one line. Starting with an unsigned integer as the slot ID and then a path where SoftHSM can
create a SQLite database. These parameters are separated by a semicolon. It is OK to have extra space between the parameters, since these
will be ignored.
<Slot_ID>:<Path_to_the_token_database>
It is also possible to add comments in the file by using the hash sign. Anything after the hash sign will be ignored.
#<text>
Any line that does not have the correct format will be ignored.
EXAMPLE
0:/var/softhsm/slot0.db
1:/home/user/token.database # My own token
ENVIRONMENT
SOFTHSM_CONF
When defined, the value will be used as path to the configuration file.
FILES
/etc/softhsm/softhsm.conf
default location of the SoftHSM configuration file
/etc/softhsm/softhsm.conf.sample
an example of a SoftHSM configuration file
AUTHOR
Written by Rickard Bellgrim.
SEE ALSO softhsm(1), softhsm-keyconv(1).
SoftHSM 21 December 2009 softhsm.conf(5)
Check Out this Related Man Page
PKCS11-TOOL(1) OpenSC tools PKCS11-TOOL(1)NAME
pkcs11-tool - utility for managing and using PKCS #11 security tokens
SYNOPSIS
pkcs11-tool [OPTIONS]
DESCRIPTION
The pkcs11-tool utility is used to manage the data objects on smart cards and similar PKCS #11 security tokens. Users can list and read
PINs, keys and certificates stored on the token. User PIN authentication is performed for those operations that require it.
OPTIONS --login, -l
Authenticate to the token before performing other operations. This option is not needed if a PIN is provided on the command line.
--pin pin, -p pin
Use the given pin for token operations. WARNING: Be careful using this option as other users may be able to read the command line from
the system or if it is embedded in a script.
This option will also set the --login option.
--so-pin pin
Use the given pin as the Security Officer PIN for some token operations (token initialization, user PIN initialization, etc). The same
warning as --pin also applies here.
--init-token
Initializes a token: set the token label as well as a Security Officer PIN (the label must be specified using --label).
--init-pin
Initializes the user PIN. This option differs from --change-pin in that it sets the user PIN for the first time. Once set, the user PIN
can be changed using --change-pin.
--change-pin, -c
Change the user PIN on the token
--test, -t
Performs some tests on the token. This option is most useful when used with either --login or --pin.
--show-info, -I
Displays general token information.
--list-slots, -L
Displays a list of available slots on the token.
--list-mechanisms, -M
Displays a list of mechanisms supported by the token.
--list-objects, -O
Displays a list of objects.
--sign, s
Sign some data.
--hash, -h
Hash some data.
--mechanism mechanism, -m mechanism
Use the specified mechanism for token operations. See -M for a list of mechanisms supported by your token.
--keypairgen, -k
Generate a new key pair (public and private pair.)
--write-object id, -w path
Write a key or certificate object to the token. path points to the DER-encoded certificate or key file.
--type type, -y type
Specify the type of object to operate on. Examples are cert, privkey and pubkey.
--id id, -d id
Specify the id of the object to operate on.
--label name, -a name
Specify the name of the object to operate on (or the token label when --init-token is used).
--slot id
Specify the id of the slot to use.
--slot-description description
Specify the description of the slot to use.
--slot-index index
Specify the index of the slot to use.
--token-label label
Specify the label of token. Will be used the first slot, that has the inserted token with this label.
--set-id id, -e id
Set the CKA_ID of the object.
--attr-from path
Extract information from path (DER-encoded certificate file) and create the corresponding attributes when writing an object to the
token. Example: the certificate subject name is used to create the CKA_SUBJECT attribute.
--input-file path, -i path
Specify the path to a file for input.
--output-file path, -o path
Specify the path to a file for output.
--module mod
Specify a PKCS#11 module (or library) to load.
--moz-cert path, -z path
Tests a Mozilla-like keypair generation and certificate request. Specify the path to the certificate file.
--verbose, -v
Causes pkcs11-tool to be more verbose.
NB! This does not affect OpenSC debugging level! To set OpenSC PKCS#11 module into debug mode, set the OPENSC_DEBUG environment
variable to a non-zero number.
opensc 06/03/2012 PKCS11-TOOL(1)