{"id":21452656,"url":"https://github.com/nmrr/nitrokeyhsm-cheatsheet","last_synced_at":"2026-01-03T06:47:45.430Z","repository":{"id":179743026,"uuid":"664067069","full_name":"nmrr/nitrokeyhsm-cheatsheet","owner":"nmrr","description":"A cheat sheet of PKCS11 command to use Nitrokey HSM 2 (or other PKCS11 HSM)","archived":false,"fork":false,"pushed_at":"2023-07-11T06:08:51.000Z","size":6,"stargazers_count":3,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-01-23T12:32:16.216Z","etag":null,"topics":["cryptography","hardware-security-module","hsm","pkcs11","smartcard"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nmrr.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-07-08T20:33:46.000Z","updated_at":"2025-01-04T08:06:31.000Z","dependencies_parsed_at":null,"dependency_job_id":"62271e98-274e-4b58-8913-baef3297f6cf","html_url":"https://github.com/nmrr/nitrokeyhsm-cheatsheet","commit_stats":null,"previous_names":["nmrr/nitrokeyhsm-cheatsheet"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nmrr%2Fnitrokeyhsm-cheatsheet","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nmrr%2Fnitrokeyhsm-cheatsheet/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nmrr%2Fnitrokeyhsm-cheatsheet/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nmrr%2Fnitrokeyhsm-cheatsheet/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nmrr","download_url":"https://codeload.github.com/nmrr/nitrokeyhsm-cheatsheet/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243965282,"owners_count":20375905,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cryptography","hardware-security-module","hsm","pkcs11","smartcard"],"created_at":"2024-11-23T04:31:12.046Z","updated_at":"2026-01-03T06:47:45.368Z","avatar_url":"https://github.com/nmrr.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# nitrokeyhsm-cheatsheet\n\nThis document has been made for **Nitrokey HSM 2** but these commands will work for every PKCS11 HSM.\n\n \nList detected smartcard (HSM is considered as a smartcard) and associated object of smartcard: \n\n```\npkcs15-tool -D\n```\n\nReset the HSM:\n\n```\nsc-hsm-tool --initialize --so-pin *XXXX* --pin *YYYY*\n```\nThe HSM will be reinitialized. Evey keys will be erase.\n\nChange the so-pin:\n\n```\npkcs11-tool --module /usr/lib/[...]/pkcs11/opensc-pkcs11.so --login --login-type so --so-pin *XXXX* --change-pin --new-pin *YYYY*\n```\n**If the so-pin is lost, you must reflash your NitroKey and all keys will be lost !**\n\nGenerate an RSA keypair of 2048 bits with 1 as ID and \"mynewkew\" as label:\n\n```\npkcs11-tool --module /usr/lib/[...]/pkcs11/opensc-pkcs11.so --login --keypairgen --key-type rsa:2048 --id 1 --label mynewkey\n```\n**ID** must be unique for each object. You can check with **pkcs15-tool -D** command if the chosen ID is not already used:\n\n\nRead the public key of the just created RSA key (ID of the key must be passed):\n\n```\npkcs15-tool --read-public-key 1\n```\nOutput key is encored in **PEM**. Private key cannot be extracted.\n\nRead the public key and decode the key with **openssl**:\n\n```\npkcs15-tool --read-public-key 1 | openssl rsa -noout -text -inform PEM -pubin\n```\n\nList **URI** of smartcard :\n\n```\np11tool --list-all\n```\nAll **URI** start with **pkcs11:model=...**\n\nList **URI** of objects that are stored in the **HSM**:\n\n```\np11tool --login --list-all *URI*\n```\n**URI** is needed to perform action with the associate object (encrypt data with a stored key for example)\n\n\nTo encrypt a file with a RSA public key:\n\n```\nopenssl rsautl -encrypt -engine pkcs11 -keyform engine -inkey *URI* -in data.txt -out data_encrypted.txt\n```\n**URI** must end with **type=public**\n\nNote: This action can be done directly on the computer without using the HSM. A public key is public and can be shared with everyone\n\nTo decrypt the previous encrypted file with the private key:\n```\nopenssl rsautl -decrypt -engine pkcs11 -keyform engine -inkey *URI* -in data_encrypted.txt -out data_clear.txt\n```\n**URI** must end with **type=private**\n\nLength of data that can be encrypted by using RSA is limited by the size of the RSA key (256 byte for RSA-2048). Furthermore, padding will reduce the maximum length of data by 8 byte.\n\n\n## PKI\n\nGenerate an RSA keypair:\n\n```\npkcs11-tool --module /usr/lib/[...]/pkcs11/opensc-pkcs11.so --login --keypairgen --key-type rsa:2048 --id *ID* --label CA\n```\n\nGenerate the **certification authority**:\n\n```\nopenssl req -new -x509 -days 3650 -subj '/CN=CA-2023/' -sha256 -engine pkcs11 -keyform engine -key *URI* -out CA_2023.pem\n```\n\n**URI** must be the just generated private key.\n\nSign a certificate request (CSR file):\n\n```\nopenssl x509 -req -CAkeyform engine -engine pkcs11 -in mycsr.csr -days 365 -CA CA-2023.pem -CAkey *URI* -set_serial *serial_number* -sha256 -extensions req_ext -extfile extension.cnf -out mycert.pem\n```\n\nExample of extension file:\n```\n[req]\ndistinguished_name = req_distinguished_name\nreq_extensions = req_ext\nprompt = no\n\n[req_distinguished_name]\nCN  = abcd.local\n\n[req_ext]\nsubjectAltName = @alt_names\n\n[alt_names]\nIP.1 = 127.0.0.1\nDNS.1 = abcd.local\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnmrr%2Fnitrokeyhsm-cheatsheet","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnmrr%2Fnitrokeyhsm-cheatsheet","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnmrr%2Fnitrokeyhsm-cheatsheet/lists"}