---
name: "softhsm2.conf"
section: "5"
platform: "linux"
package: "softhsm"
version: "2.7.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/softhsm2.conf"
---

# softhsm2.conf(5)

SoftHSM configuration file

## NAME

softhsm2.conf - SoftHSM configuration file

## SYNOPSIS

**softhsm2.conf**

## DESCRIPTION

This is the configuration file for SoftHSM. It can be found on a default location, but can also be relocated by using the environment variable. Any configuration must be done according to the file format found in this document.

## FILE FORMAT

Each configuration option is a pair of name and value separated by a equality sign. The configuration option must be located on a single line.

```
<name> = <value>
```

It is also possible to add comments in the file by using the hash sign. Anything after the hash sign will be ignored.

```
# A comment
```

Any empty lines or lines that does not have the correct format will be ignored.

## DIRECTORIES.TOKENDIR

The location where SoftHSM can store the tokens.

```
directories.tokendir = /var/lib/softhsm/tokens/
```

## OBJECTSTORE.BACKEND

The backend to use by SoftHSM to store token objects. Either "file" or "db" is supported. In order to use the "db" backend, the SoftHSM build needs to be configured with "configure --with-objectstore-backend-db"

```
objectstore.backend = file
```

## OBJECTSTORE.UMASK

The file mode creation mask used by SoftHSM when creating files or directories. This value is in octal. This is applied in addition to the process umask and cannot override it.

```
objectstore.umask = 0077
```

## LOG.LEVEL

The log level which can be set to ERROR, WARNING, INFO or DEBUG.

```
log.level = INFO
```

## SLOTS.REMOVABLE

If set to true CKF\_REMOVABLE\_DEVICE is set in the flags returned by C\_GetSlotInfo. Default is false.

```
slots.removable = true
```

## SLOTS.MECHANISMS

Allows to enable and disable any of the PKCS#11 mechanisms reported in the C\_GetMechanismList(). The option accepts string argument containing the comma separated list of all algorithms that should be enabled (do not forget about the keygen mechanisms). The list can be prefixed with minus sign "-" to list only the disabled mechanisms. Additionally, special keyword ALL can be used to enable all the known mechanisms (default). Unknown mechanisms are ignored. This option has higher priority than the CKA\_ALLOWED\_MECHANISMS attribute on the key objects.

```
slots.mechanisms = ALL
```

## LIBRARY.RESET\_ON\_FORK

If set to true, the library will reset the state on fork. Default is false.

```
library.reset_on_fork = true
```

## ENVIRONMENT

- SOFTHSM2\_CONF

  When defined, the value will be used as path to the configuration file.

## FILES

- *~/.config/softhsm2/softhsm2.conf*

  default user-specific location of the SoftHSM configuration file; if it exists it will override the system wide configuration

- */etc/softhsm2.conf*

  default system-wide location of the SoftHSM configuration file

- */etc/softhsm2.conf.sample*

  an example of a SoftHSM configuration file

## AUTHOR

Written by Rickard Bellgrim, Francis Dupont, René Post, and Roland van Rijswijk.

## SEE ALSO

[*softhsm2-keyconv*(1)](/softhsm2-keyconv/1.md), [*softhsm2-migrate*(1)](/softhsm2-migrate/1.md), [*softhsm2-util*(1)](/softhsm2-util/1.md)