--- name: "p11-kit" section: "8" platform: "linux" package: "p11-kit" version: "0.26.5-1" release: "Arch Linux 2026-11-01" platforms: ["linux"] url: "https://new.carta.tech/p11-kit/8" --- # p11-kit(8) Tool for operating on configured PKCS#11 modules ## NAME p11-kit - Tool for operating on configured PKCS#11 modules ## SYNOPSIS **p11-kit list-modules** **p11-kit list-tokens ...** **p11-kit list-objects ...** **p11-kit import-object ...** **p11-kit export-object ...** **p11-kit delete-object ...** **p11-kit generate-keypair ...** **p11-kit list-profiles ...** **p11-kit add-profile ...** **p11-kit delete-profile ...** **p11-kit list-mechanisms ...** **p11-kit print-config** **p11-kit extract ...** **p11-kit server ...** ## DESCRIPTION **p11-kit** is a command line tool that can be used to perform operations on PKCS#11 modules configured on the system. See the various sub commands below. The following global options can be used: - **-v, --verbose** Run in verbose mode with debug output. - **-q, --quiet** Run in quiet mode without warning or failure messages. ## LIST MODULES List system configured PKCS#11 modules. ``` $ p11-kit list-modules ``` The modules, information about them and the tokens present in the PKCS#11 modules will be displayed. ## LIST TOKENS List all tokens available in system configured PKCS#11 modules. ``` $ p11-kit list-tokens pkcs11:token ``` This retrieves all tokens and displays some of their common attributes. This subcommand takes the following options: **--only-uris** Print only the matching token URIs. **--provider=\** Load only the given PKCS#11 module instead of enumerating modules installed on the system. If *module\_path* is a relative path, the module is loaded from the default module path. This path can be determined by running: ``` $ pkg-config p11-kit-1 --variable p11_module_path /usr/lib64/pkcs11 ``` ## LIST OBJECTS List objects matching given PKCS#11 URI. ``` $ p11-kit list-objects pkcs11:object_on_token ``` This retrieves all objects that match given PKCS#11 URI and displays some of their common attributes. Storage objects also have their PKCS#11 URI displayed. This subcommand takes the following options: **--login** Authenticate to the token before enumerating objects. The PIN value is read from either the pin-value attribute in the URI or from the terminal. **--provider=\** Load only the given PKCS#11 module instead of enumerating modules installed on the system. If *module\_path* is a relative path, the module is loaded from the default module path. This path can be determined by running: ``` $ pkg-config p11-kit-1 --variable p11_module_path /usr/lib64/pkcs11 ``` ## IMPORT OBJECT Import object into PKCS#11 token. ``` $ p11-kit import-object --file=file.pem [--label=label] [--id=object_id] pkcs11:token ``` Takes either an X.509 certificate or a public key in the form of a PEM file and imports it into the first token matched by given PKCS#11 URI. The following options are required: **--file=\** File containing either an X.509 certificate or a public key in PEM format. This subcommand also accepts the following options: **--label=\** Assigns label to the imported object. **--id=\** Assigns ID to the imported object. The ID should be specified in hexadecimal format without '0x' prefix. **--login** Authenticate to the token before enumerating objects. The PIN value is read from either the pin-value attribute in the URI or from the terminal. **--provider=\** Load only the given PKCS#11 module instead of enumerating modules installed on the system. If *module\_path* is a relative path, the module is loaded from the default module path. This path can be determined by running: ``` $ pkg-config p11-kit-1 --variable p11_module_path /usr/lib64/pkcs11 ``` ## EXPORT OBJECT Export object matching PKCS#11 URI. ``` $ p11-kit export-object pkcs11:object_on_token ``` Displays PEM formatted contents of the first object matched by given PKCS#11 URI. The matched object has to either be an X.509 certificate or a public key. This subcommand takes the following options: **--login** Authenticate to the token before enumerating objects. The PIN value is read from either the pin-value attribute in the URI or from the terminal. **--provider=\** Load only the given PKCS#11 module instead of enumerating modules installed on the system. If *module\_path* is a relative path, the module is loaded from the default module path. This path can be determined by running: ``` $ pkg-config p11-kit-1 --variable p11_module_path /usr/lib64/pkcs11 ``` ## DELETE OBJECT Delete object matching PKCS#11 URI. ``` $ p11-kit delete-object pkcs11:object_on_token ``` Destroys the first object matched by given PKCS#11 URI. This subcommand takes the following options: **--login** Authenticate to the token before enumerating objects. The PIN value is read from either the pin-value attribute in the URI or from the terminal. **--provider=\** Load only the given PKCS#11 module instead of enumerating modules installed on the system. If *module\_path* is a relative path, the module is loaded from the default module path. This path can be determined by running: ``` $ pkg-config p11-kit-1 --variable p11_module_path /usr/lib64/pkcs11 ``` ## GENERATE KEY-PAIR Generate key-pair on a PKCS#11 token. ``` $ p11-kit generate-keypair --type=algorithm {--bits=n|--curve=name} [--label=label] [--id=object_id] pkcs11:token ``` Generate private-public key-pair of given type on the first token matched by given PKCS#11 URI. This command should be used together with --type option and one of --bits or --curve options. The following options are required: **--type=\** Specify the type of keys to generate. Supported values are rsa, ecdsa and eddsa. **--bits=\** Specify the number of bits for the key-pair generation. Cannot be used together with --curve option. **--curve=\** Specify an elliptic curve for the key-pair generation. Supported values are secp256r1, secp384r1, secp521r1, ed25519 and ed448. Cannot be used together with --bits option. This subcommand also accepts the following options: **--label=\** Assigns label to the generated key-pair objects. **--id=\** Assigns ID to the generated key-pair objects. The ID should be specified in hexadecimal format without '0x' prefix. **--login** Authenticate to the token before enumerating objects. The PIN value is read from either the pin-value attribute in the URI or from the terminal. **--provider=\** Load only the given PKCS#11 module instead of enumerating modules installed on the system. If *module\_path* is a relative path, the module is loaded from the default module path. This path can be determined by running: ``` $ pkg-config p11-kit-1 --variable p11_module_path /usr/lib64/pkcs11 ``` ## LIST PROFILES List PKCS#11 profiles supported by the token. ``` $ p11-kit list-profiles pkcs11:token ``` Displays profile IDs of the first token matched by given PKCS#11 URI in human-readable form. This subcommand takes the following options: **--login** Authenticate to the token before enumerating objects. The PIN value is read from either the pin-value attribute in the URI or from the terminal. **--provider=\** Load only the given PKCS#11 module instead of enumerating modules installed on the system. If *module\_path* is a relative path, the module is loaded from the default module path. This path can be determined by running: ``` $ pkg-config p11-kit-1 --variable p11_module_path /usr/lib64/pkcs11 ``` ## ADD PROFILE Add PKCS#11 profile to a token. ``` $ p11-kit add-profile --profile=profile pkcs11:token ``` Creates new profile object with given profile ID on the first token matched by given PKCS#11 URI. This command fails if the profile ID already exists on the token. The following options are required: **--profile=\** Profile ID to add. Value can either be numerical or textual. This subcommand also accepts the following options: **--login** Authenticate to the token before enumerating objects. The PIN value is read from either the pin-value attribute in the URI or from the terminal. **--provider=\** Load only the given PKCS#11 module instead of enumerating modules installed on the system. If *module\_path* is a relative path, the module is loaded from the default module path. This path can be determined by running: ``` $ pkg-config p11-kit-1 --variable p11_module_path /usr/lib64/pkcs11 ``` ## DELETE PROFILE Delete PKCS#11 profile from a token. ``` $ p11-kit delete-profile --profile=profile pkcs11:token ``` Destroys all profile objects with given profile ID from the first token matched by given PKCS#11 URI. The following options are required: **--profile=\** Profile ID to delete. Value can either be numerical or textual. This subcommand also accepts the following options: **--login** Authenticate to the token before enumerating objects. The PIN value is read from either the pin-value attribute in the URI or from the terminal. **--provider=\** Load only the given PKCS#11 module instead of enumerating modules installed on the system. If *module\_path* is a relative path, the module is loaded from the default module path. This path can be determined by running: ``` $ pkg-config p11-kit-1 --variable p11_module_path /usr/lib64/pkcs11 ``` ## LIST MECHANISMS List PKCS#11 mechanisms supported by the token. ``` $ p11-kit list-mechanisms pkcs11:token ``` This lists all available mechanimsms for a PKCS#11 token ## PRINT CONFIG Print merged configuration. ``` $ p11-kit print-config ``` P11-kit provides 3 levels of configuration: system wide, per-module, and per-user. At run-time all 3 levels are merged into a single configuration. This command displays the merged configuration. ## EXTRACT Extract certificates from configured PKCS#11 modules. This operation has been moved to a separate command **trust extract**. See [**trust**(1)](/trust/1.md) for more information ## SERVER Run a server process that exposes PKCS#11 module remotely. ``` $ p11-kit server pkcs11:token1 pkcs11:token2 ... $ p11-kit server --provider /path/to/pkcs11-module.so pkcs11:token1 pkcs11:token2 ... ``` This launches a server that exposes the given PKCS#11 tokens on a local socket. The tokens must belong to the same module. To access the socket, use p11-kit-client.so module. The server address and PID are printed as a shell-script snippet which sets the appropriate environment variable: P11\_KIT\_SERVER\_ADDRESS and P11\_KIT\_SERVER\_PID. ## EXTRACT TRUST Extract standard trust information files. This operation has been moved to a separate command **trust extract-compat**. See [**trust**(1)](/trust/1.md) for more information ## REMOTE Run a PKCS#11 module remotely. ``` $ p11-kit remote /path/to/pkcs11-module.so $ p11-kit remote pkcs11:token1 pkcs11:token2 ... ``` This is not meant to be run directly from a terminal. But rather in a **remote** option in a [**pkcs11.conf**(5)](/pkcs11.conf/5.md) file. This exposes the given PKCS#11 module or tokens over standard input and output. Those two forms, whether to expose a module or tokens, are mutually exclusive and if the second form is used, the tokens must belong to the same module. ## BUGS Please send bug reports to either the distribution bug tracker or the upstream bug tracker at **https://github.com/p11-glue/p11-kit/issues/**. ## SEE ALSO [**pkcs11.conf**(5)](/pkcs11.conf/5.md) Further details available in the p11-kit online documentation at **https://p11-glue.github.io/p11-glue/p11-kit/manual/**.