Install pkcs11-tools with Homebrew

Project links

• Homepage
• Package manager page

Commands and aliases

• masqreq
• p11cat
• p11cp
• p11importcert
• p11importdata
• p11importpubk
• p11init
• p11kcv
• p11keycomp
• p11keygen
• p11ls
• p11mkcert
• p11more
• p11mv
• p11od
• p11req
• p11rewrap
• p11rm
• p11setattr
• p11slotinfo
• p11unwrap
• p11wrap
• with_aws
• with_beid
• with_kryoptic
• with_luna
• with_nfast
• with_nss
• with_pkcs11_common
• with_softhsm
• with_utimaco
• with_yubico

Project history

pkcs11-tools was created to provide unified, interoperable key-management primitives for cryptographic tokens implementing PKCS#11. The official manual cites underspecified object conventions, differences between Java implementations, cumbersome JVM setup, and proprietary vendor tools as motivations.

The toolkit evolved through releases adding templates and broader attribute handling, CKA_ALLOWED_MECHANISMS support, JWK output, reworked vendor wrappers, OpenSSL 3 migration, and support for the ML-KEM, ML-DSA, and SLH-DSA post-quantum algorithms.

Adoption history

The toolkit targets a range of hardware and software PKCS#11 implementations rather than a single vendor. Official documentation covers major HSM brands and software tokens including SoftHSM, NSS, and Kryoptic, as well as interoperability with IBM and Oracle Java environments.

It is available through Homebrew, while the source documentation also covers Linux, macOS, AIX, Solaris, and cross-compiled Windows builds.

How it is used

Users select a PKCS#11 library and token by command options or environment variables, then use focused p11 commands to list, inspect, generate, import, move, remove, wrap, or unwrap objects and to create CSRs or certificates.

Vendor-oriented with_* wrappers can auto-detect libraries and read .pkcs11rc or .pkcs11rc.<vendor> files. The search begins in the current directory and proceeds upward to $HOME. These shell-sourced files may contain PKCS11PASSWORD, so they can also act as credential-bearing files and require appropriate permissions.

Why package nerds care

The project supplies Unix-like commands such as p11ls, p11mv, p11rm, p11od, and p11more for a security API whose vendor tooling is often proprietary and inconsistent. That composable command vocabulary makes heterogeneous HSM and token administration more approachable.

Its breadth extends beyond object inspection to key generation, wrapping, certificate import, CSR creation, token initialization, vendor wrapper scripts, shell completion, and post-quantum PKCS#11 algorithms.

Timeline

• July 2021: Version 2.4 added template support to numerous key-management commands.
• October 2021: Version 2.5 added CKA_ALLOWED_MECHANISMS support and advanced the wrapped-key grammar.
• June 2023: Version 2.6 added JWK output to key-generation and wrapping commands.
• Later development: The toolkit moved to OpenSSL 3 and added PKCS#11 v3.2 post-quantum algorithms.

Related projects

• PKCS#11 is the standard interface around which the toolkit is built.
• SoftHSM, NSS, and Kryoptic are supported software-token implementations.
• libpkcs11shim can be installed separately to trace PKCS#11 calls through the wrapper scripts.

Sources

• Official installation guide: https://github.com/Mastercard/pkcs11-tools/blob/master/docs/INSTALL.md
• Official manual: https://github.com/Mastercard/pkcs11-tools/blob/master/docs/MANUAL.md
• Official repository: https://github.com/Mastercard/pkcs11-tools