NAME

       p11tool - Manipulate PKCS #11 tokens.

SYNOPSIS

       p11tool [options]

DESCRIPTION

       Export/import  data  from  PKCS  #11  tokens.  To  use  PKCS  #11  tokens  with gnutls the
       configuration file /etc/gnutls/pkcs11.conf has to exist and contain a number of  lines  of
       the form "load=/usr/lib/opensc-pkcs11.so".

OPTIONS

   Program control options
       -d, --debug LEVEL
              Specify the debug level. Default is 1.

       -h, --help
              Shows this help text

   Generic options
       --login
              Force login to the token for the intended operation.

       --provider MODULE
              In addition to /etc/gnutls/pkcs11.conf, load the specified module.

       --outfile FILE
              Print output to FILE.

       --inder, --inraw
              Input is DER formatted.

   Getting information on available X.509 certificates
       --list-tokens
              Prints all available tokens.

       --initialize URL
              Initializes  (formats)  the specified by the URL token. Note that several tokens do
              not support this fascility.

   Getting information on available X.509 certificates
       --list-all-certs
              Prints all available certificates.

       --list-certs
              Prints all certificates that have a corresponding private key stored in the token.

       --list-trusted
              Prints all certificates that have been marked as trusted.

   Getting information on private keys
       --list-privkeys
              Prints all available private keys.

   Handling generic objects
       --export URL
              Exports the object (e.g. certificate) specified by the URL.

       --delete URL
              Deletes the object specified by the URL. Note that several tokens  do  not  support
              deletion.

       --detailed-url
              When printing URLs print them in a detailed (to the PKCS #11 module used) form.

       --no-detailed-url
              When printing URLs, do not print details on the module used.

   Storing objects
       --write URL
              Flag  to set when writing an object. Requires one of --load-privkey, --load-pubkey,
              --load-certificate or --secret-key options.

       --load-privkey
              Load a private key for the write operations.

       --load-pubkey
              Load an X.509 subjectPublicKey for the write operation.

       --load-certificate
              Load an X.509 certificate for the write operation.

       --secret-key
              Specify a hex encoded secret key for the write operation.

       --trusted
              The object stored will be marked as trusted.

       --label
              The label of the object stored.

   Controlling output
       -8, --pkcs8
              Use PKCS #8 format for private keys.

EXAMPLES

       To store a private key and certificate, run:

              $ p11tool --login --write "pkcs11:XXX"  --load-privkey key.pem --label "MyKey"
              $ p11tool --login --write "pkcs11:XXX"  --load-certificate cert.pem --label "MyCert"

       To view all objects in a token, use:

              $ p11tool --login --list-all

AUTHOR

       Nikos       Mavrogiannopoulos       <nmav@gnutls.org>        and        others;        see
       /usr/share/doc/gnutls-bin/AUTHORS for a complete list.

                                        November 11th 2010                             p11tool(1)