Skip to main content

Integrating with pkcs11-tool

Overview​

pkcs11-tool is a command-line utility for managing and testing PKCS#11 modules. It lets you perform low-level operations directly, such as listing available keys and certificates, signing data, and verifying module configuration.

This guide provides common commands for using pkcs11-tool to interact with the Code Sign Client.

Before you begin​

Before proceeding, ensure you have the following:

  • OpenSC is installed — The pkcs11-tool utility is part of the OpenSC package. Install OpenSC on your system to make the tool available.
  • The Code Sign Client is installed — This provides the PKCS#11 library that the tool interacts with.

How do I get started?​

If you are using the portable package (.zip), add the client's bin and PKCS11 (Windows) or lib (Linux/macOS) directories to your session's PATH.

For Windows CMD (example):

set PATH=%PATH%;C:\path\to\codesign-client\bin;C:\path\to\codesign-client\PKCS11

For Linux/macOS (Bash/Zsh example):

export PATH=$PATH:/path/to/codesign-client/bin:/path/to/codesign-client/lib

The process involves three main steps: listing details, exporting a certificate and converting it to PEM format, and signing a file.

Windows integration example​

List details:

pkcs11-tool.exe --module "C:\Program Files\Venafi CodeSign Protect\PKCS11\VenafiPKCS11.dll" -O -I -M -L -T --login --login-type user --pin none

Export a certificate and convert to PEM:

pkcs11-tool --module "C:\Program Files\Venafi CodeSign Protect\PKCS11\VenafiPKCS11.dll" --login --pin none --read-object --type cert --label <label> --output-file c:\tosign\sample.crt

openssl x509 -inform der -in sample.crt -out sample.pem

Sign a file:

pkcs11-tool.exe --module "C:\Program Files\Venafi CodeSign Protect\PKCS11\VenafiPKCS11.dll" -O -I -M -L -T --login --login-type user --pin none --sign --id 53616d706c652d446576656c6f706d656e742d456e7669726f6e6d656e74 -i c:\tosign\test.txt -o c:\tosign\test.text.sig -m SHA512-RSA-PKCS

Linux integration example​

List details:

pkcs11-tool --module /opt/venafi/codesign/lib/venafipkcs11.so -I -O -M --login --pin none

Export a certificate and convert to PEM:

pkcs11-tool --module /opt/venafi/codesign/lib/venafipkcs11.so --login --pin none --read-object --type cert --label Sample-Development-Environment --output-file sample.crt

openssl x509 -inform der -in sample.crt -out sample.pem

Sign a file:

pkcs11-tool --module /opt/venafi/codesign/lib/venafipkcs11spy.so -I -M -L -T -O \
--login --login-type user --pin none --sign --id 53616d706c652d446576656c6f706d656e742d456e7669726f6e6d656e74 \
-i /tmp/test -o /tmp/test.txt.sig -m SHA512-RSA-PKCS

macOS integration example​

List details:

pkcs11-tool --module /usr/local/lib/venafipkcs11.so -I -O -M --login --pin none

Export a certificate and convert to PEM:

pkcs11-tool --module /usr/local/lib/venafipkcs11.so --login --pin none --read-object --type cert --label Sample-Development-Environment --output-file sample.crt

openssl x509 -inform der -in sample.crt -out sample.pem

Sign a file:

pkcs11-tool --module /usr/local/lib/venafipkcs11.so -I -M -L -T -O \
--login --login-type user --pin none --sign --id 53616d706c652d446576656c6f706d656e742d456e7669726f6e6d656e74 \
-i /tmp/test -o /tmp/test.txt.sig -m SHA512-RSA-PKCS