1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<!-- This manual is last updated 4 March 2015 for version
3.4.8 of GnuTLS.
Copyright (C) 2001-2015 Free Software Foundation, Inc.\\
Copyright (C) 2001-2015 Nikos Mavrogiannopoulos
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.3 or
any later version published by the Free Software Foundation; with no
Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A
copy of the license is included in the section entitled "GNU Free
Documentation License". -->
<!-- Created by GNU Texinfo 6.0, http://www.gnu.org/software/texinfo/ -->
<head>
<title>GnuTLS 3.4.8: PKCS11 Initialization</title>
<meta name="description" content="GnuTLS 3.4.8: PKCS11 Initialization">
<meta name="keywords" content="GnuTLS 3.4.8: PKCS11 Initialization">
<meta name="resource-type" content="document">
<meta name="distribution" content="global">
<meta name="Generator" content="makeinfo">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<link href="index.html#Top" rel="start" title="Top">
<link href="Function-and-Data-Index.html#Function-and-Data-Index" rel="index" title="Function and Data Index">
<link href="index.html#SEC_Contents" rel="contents" title="Table of Contents">
<link href="Smart-cards-and-HSMs.html#Smart-cards-and-HSMs" rel="up" title="Smart cards and HSMs">
<link href="Accessing-objects-that-require-a-PIN.html#Accessing-objects-that-require-a-PIN" rel="next" title="Accessing objects that require a PIN">
<link href="Smart-cards-and-HSMs.html#Smart-cards-and-HSMs" rel="prev" title="Smart cards and HSMs">
<style type="text/css">
<!--
a.summary-letter {text-decoration: none}
blockquote.indentedblock {margin-right: 0em}
blockquote.smallindentedblock {margin-right: 0em; font-size: smaller}
blockquote.smallquotation {font-size: smaller}
div.display {margin-left: 3.2em}
div.example {margin-left: 3.2em}
div.lisp {margin-left: 3.2em}
div.smalldisplay {margin-left: 3.2em}
div.smallexample {margin-left: 3.2em}
div.smalllisp {margin-left: 3.2em}
kbd {font-style: oblique}
pre.display {font-family: inherit}
pre.format {font-family: inherit}
pre.menu-comment {font-family: serif}
pre.menu-preformatted {font-family: serif}
pre.smalldisplay {font-family: inherit; font-size: smaller}
pre.smallexample {font-size: smaller}
pre.smallformat {font-family: inherit; font-size: smaller}
pre.smalllisp {font-size: smaller}
span.nocodebreak {white-space: nowrap}
span.nolinebreak {white-space: nowrap}
span.roman {font-family: serif; font-weight: normal}
span.sansserif {font-family: sans-serif; font-weight: normal}
ul.no-bullet {list-style: none}
body {
margin: 2%;
padding: 0 5%;
background: #ffffff;
}
h1,h2,h3,h4,h5 {
font-weight: bold;
padding: 5px 5px 5px 5px;
background-color: #c2e0ff;
color: #336699;
}
h1 {
padding: 2em 2em 2em 5%;
color: white;
background: #336699;
text-align: center;
letter-spacing: 3px;
}
h2 { text-decoration: underline; }
pre {
margin: 0 5%;
padding: 0.5em;
}
pre.example,pre.verbatim {
padding-bottom: 1em;
border: solid #c2e0ff;
background: #f0faff;
border-width: 1px 1px 1px 5px;
margin: 1em auto;
width: 90%;
}
div.node {
margin: 0 -5% 0 -2%;
padding: 0.5em 0.5em;
margin-top: 0.5em;
margin-bottom: 0.5em;
font-weight: bold;
}
dd, li {
padding-top: 0.1em;
padding-bottom: 0.1em;
}
div.float {
margin-bottom: 0.5em;
text-align: center;
}
table {
text-align: left;
margin-left:auto;
margin-right:auto;
border-spacing: 7px;
width: 50%;
}
th {
padding: 0;
color: #336699;
background-color: #c2e0ff;
border: solid #000000;
border-width: 0px;
margin: 1em auto;
text-align: center;
margin-left:auto;
margin-right:auto;
}
td {
padding: 0;
border: solid #000000;
background-color: #f0faff;
border-width: 0px;
margin: 1em auto;
text-align: left;
margin-left:auto;
margin-right:auto;
padding-left: 1em;
}
dl {
text-align: left;
margin-left:auto;
margin-right:auto;
width: 50%;
padding-left: 1em;
border: solid #c2e0ff;
background: #f0faff;
border-width: 5px 1px 1px 1px;
margin: 1em auto;
}
-->
</style>
</head>
<body lang="en">
<a name="PKCS11-Initialization"></a>
<div class="header">
<p>
Next: <a href="Accessing-objects-that-require-a-PIN.html#Accessing-objects-that-require-a-PIN" accesskey="n" rel="next">Accessing objects that require a PIN</a>, Up: <a href="Smart-cards-and-HSMs.html#Smart-cards-and-HSMs" accesskey="u" rel="up">Smart cards and HSMs</a> [<a href="index.html#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="Function-and-Data-Index.html#Function-and-Data-Index" title="Index" rel="index">Index</a>]</p>
</div>
<hr>
<a name="Initialization-1"></a>
<h4 class="subsection">5.3.1 Initialization</h4>
<p>To allow all <acronym>GnuTLS</acronym> applications to transparently access smard cards
and tokens, <acronym>PKCS</acronym> #11 is automatically initialized during the first
call of a <acronym>PKCS</acronym> #11 related function. The initialization process, based
on p11-kit configuration, loads any appropriate modules. The p11-kit configuration
files<a name="DOCF12" href="#FOOT12"><sup>12</sup></a> are typically stored in <code>/etc/pkcs11/modules/</code>.
For example a file that will instruct GnuTLS to load the <acronym>OpenSC</acronym> module,
could be named <code>/etc/pkcs11/modules/opensc.module</code> and contain the following:
</p>
<div class="example">
<pre class="example">module: /usr/lib/opensc-pkcs11.so
</pre></div>
<p>If you use these configuration files, then there is no need for other initialization in
<acronym>GnuTLS</acronym>, except for the PIN and token callbacks (see next section).
In several cases, however, it is desirable to limit badly behaving modules
(e.g., modules that add an unacceptable delay on initialization)
to single applications. That can be done using the “enable-in:” option
followed by the base name of applications that this module should be used.
</p>
<p>It is also possible to manually initialize the PKCS #11 subsystem if the
default settings are not desirable. To completely disable PKCS #11 support you
need to call <a href="PKCS-11-API.html#gnutls_005fpkcs11_005finit">gnutls_pkcs11_init</a> with the flag <code>GNUTLS_PKCS11_FLAG_MANUAL</code>
prior to <a href="Core-TLS-API.html#gnutls_005fglobal_005finit">gnutls_global_init</a>.
</p>
<dl>
<dt><a name="index-gnutls_005fpkcs11_005finit"></a>Function: <em>int</em> <strong>gnutls_pkcs11_init</strong> <em>(unsigned int <var>flags</var>, const char * <var>deprecated_config_file</var>)</em></dt>
<dd><p><var>flags</var>: An ORed sequence of <code>GNUTLS_PKCS11_FLAG_</code> *
</p>
<p><var>deprecated_config_file</var>: either NULL or the location of a deprecated
configuration file
</p>
<p>This function will initialize the PKCS 11 subsystem in gnutls. It will
read configuration files if <code>GNUTLS_PKCS11_FLAG_AUTO</code> is used or allow
you to independently load PKCS 11 modules using <code>gnutls_pkcs11_add_provider()</code>
if <code>GNUTLS_PKCS11_FLAG_MANUAL</code> is specified.
</p>
<p>You don’t need to call this function since GnuTLS 3.3.0 because it is being called
during the first request PKCS 11 operation. That call will assume the <code>GNUTLS_PKCS11_FLAG_AUTO</code>
flag. If another flags are required then it must be called independently
prior to any PKCS 11 operation.
</p>
<p><strong>Returns:</strong> On success, <code>GNUTLS_E_SUCCESS</code> (0) is returned, otherwise a
negative error value.
</p>
<p><strong>Since:</strong> 2.12.0
</p></dd></dl>
<p>Note that, PKCS #11 modules behave in a peculiar way after a fork; they
require a reinitialization of all the used PKCS #11 resources.
While GnuTLS automates that process, there are corner cases where
it is not possible to handle it correctly in an automated way<a name="DOCF13" href="#FOOT13"><sup>13</sup></a>. For that reasons it is
recommended not to mix fork() and PKCS #11 module usage. It is recommended
to initialize and use any PKCS #11 resources in a single process.
</p>
<p>Older versions of <acronym>GnuTLS</acronym> required to call <a href="PKCS-11-API.html#gnutls_005fpkcs11_005freinit">gnutls_pkcs11_reinit</a>
after a fork() call; since 3.3.0 this is no longer required.
</p>
<div class="footnote">
<hr>
<h4 class="footnotes-heading">Footnotes</h4>
<h3><a name="FOOT12" href="#DOCF12">(12)</a></h3>
<p><a href="http://p11-glue.freedesktop.org/">http://p11-glue.freedesktop.org/</a></p>
<h3><a name="FOOT13" href="#DOCF13">(13)</a></h3>
<p>For
example when an open session is to be reinitialized, but the PIN is not available
to GnuTLS (e.g., it was entered at a pinpad).</p>
</div>
<hr>
<div class="header">
<p>
Next: <a href="Accessing-objects-that-require-a-PIN.html#Accessing-objects-that-require-a-PIN" accesskey="n" rel="next">Accessing objects that require a PIN</a>, Up: <a href="Smart-cards-and-HSMs.html#Smart-cards-and-HSMs" accesskey="u" rel="up">Smart cards and HSMs</a> [<a href="index.html#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="Function-and-Data-Index.html#Function-and-Data-Index" title="Index" rel="index">Index</a>]</p>
</div>
</body>
</html>
|
