P11Ng CLI

The P11Ng CLI tool can be used to administrate HSMs using PKCS#11. It is built as a standalone JAR, which can be put on any machine and run independently of EJBCA.

The P11Ng CLI also provides CP5-specific commands to manage keys on Utimaco's common criteria certified HSM.

Build and Use P11Ng CLI

The following provides information on building and using the P11Ng CLI tool.

Build P11Ng CLI

To build P11Ng CLI with ant, run the following from the EJBCA source code directory:

ant p11ng-cli

The directory ./dist/p11ng-cli is created and can be moved to any location.

To use the tool, run the script p11ng-cli.sh in this directory.

Use P11Ng CLI

List Available Commands

Call the p11ng-cli.sh script without arguments to list all valid commands. For example:

> ./p11ng-cli.sh
--------------------------------
The following commands are available:
authorizekey Authorizes a key before it can be used. CP5 specific operation.
backupobject Backs up a key from the HSM on the backup file. CP5 specific operation.
deleteobject Deletes objects.
generatekey Generates symmetric key on the HSM
generatekeypair Generates a key pair
initializekey Initializes a key prior to authorization. CP5 specific operation.
listobjects List objects available on the slot.
listslots Lists slots available on the HSM
onetimeperformancetest Runs a one time performance test generating an RSA key and signing with it.
restoreobject Restores a backed up key from file into the HSM. CP5 specific operation.
showinfo Shows information about HSM.
showobjectattributes Shows the following attributes of an object, object IDs can be listed using the listobjects command:
CKA.ID, CKA.TOKEN, CKA.SENSITIVE, CKA.PRIVATE, CKA.EXTRACTABLE, CKA.ENCRYPT, CKA.DECRYPT, CKA.SIGN,CKA.VERIFY, CKA.SIGN_RECOVER, CKA.VERIFY_RECOVER, CKA.WRAP, CKA.UNWRAP, CKA.DERIVE, CKA.MODULUS_BITS,CKA.PUBLIC_EXPONENT, CKA.MODULUS, CKA.EC_PARAMS
showslotinfo Prints information about the slot.
showtokeninfo Prints information about token.
signperformancetest Runs a signing performance test. Without the --verify flag, the test only calls 'initSign, update, sign' using the private key, while adding --verify also reads the public key and verifies (in software) the created signature.
unblockkey Unblocks a key previously blocked. CP5 specific operation.
 
Type a command and "--help" for more information.

Print the Manual

Append the flag --help to any command to print the corresponding man page. For example:

> ./p11ng-cli.sh authorizekey --help