pkcs11-tool 命令

常用示例

说明

pkcs11-tool interacts with PKCS#11 cryptographic tokens such as smart cards, USB security keys, and hardware security modules (HSMs). It can list available slots and objects, generate key pairs, sign and verify data, and initialize tokens. Part of the OpenSC project, it communicates with tokens through PKCS#11 library modules. Different token types require their specific PKCS#11 library, specified with the --module option. Operations on private objects typically require PIN authentication.

参数

--list-token-slots

List available slots.

--list-objects

List objects on the token. Can filter with --label, --id, or --type.

--list-mechanisms

List mechanisms supported by the token.

--keypairgen

Generate a key pair on the token.

--sign

Sign data.

--verify

Verify signed data.

--init-token

Initialize a token.

--init-pin

Initialize the user PIN (first-time setup).

--change-pin

Change the user PIN.

--login, -l

Authenticate to the token before performing operations.

--pin _PIN_

Supply the PIN on the command line.

--so-pin _PIN_

Supply the Security Officer PIN (used for token initialization).

--key-type _spec_

Key type and length (e.g., rsa:2048, EC:prime256v1).

--id _ID_

Object ID (hex).

--label _LABEL_

Object label.

--slot _ID_

Specify the slot to use.

--module _LIB_

PKCS#11 library to load.

--help

Display help.