1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<!-- This manual is last updated 4 March 2015 for version
3.5.4 of GnuTLS.
Copyright (C) 2001-2015 Free Software Foundation, Inc.\\
Copyright (C) 2001-2015 Nikos Mavrogiannopoulos
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.3 or
any later version published by the Free Software Foundation; with no
Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A
copy of the license is included in the section entitled "GNU Free
Documentation License". -->
<!-- Created by GNU Texinfo 6.1, http://www.gnu.org/software/texinfo/ -->
<head>
<title>GnuTLS 3.5.4: PKCS11 Initialization</title>
<meta name="description" content="GnuTLS 3.5.4: PKCS11 Initialization">
<meta name="keywords" content="GnuTLS 3.5.4: PKCS11 Initialization">
<meta name="resource-type" content="document">
<meta name="distribution" content="global">
<meta name="Generator" content="makeinfo">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<link href="index.html#Top" rel="start" title="Top">
<link href="Function-and-Data-Index.html#Function-and-Data-Index" rel="index" title="Function and Data Index">
<link href="index.html#SEC_Contents" rel="contents" title="Table of Contents">
<link href="Smart-cards-and-HSMs.html#Smart-cards-and-HSMs" rel="up" title="Smart cards and HSMs">
<link href="PKCS11-Manual-Initialization.html#PKCS11-Manual-Initialization" rel="next" title="PKCS11 Manual Initialization">
<link href="Smart-cards-and-HSMs.html#Smart-cards-and-HSMs" rel="prev" title="Smart cards and HSMs">
<style type="text/css">
<!--
a.summary-letter {text-decoration: none}
blockquote.indentedblock {margin-right: 0em}
blockquote.smallindentedblock {margin-right: 0em; font-size: smaller}
blockquote.smallquotation {font-size: smaller}
div.display {margin-left: 3.2em}
div.example {margin-left: 3.2em}
div.lisp {margin-left: 3.2em}
div.smalldisplay {margin-left: 3.2em}
div.smallexample {margin-left: 3.2em}
div.smalllisp {margin-left: 3.2em}
kbd {font-style: oblique}
pre.display {font-family: inherit}
pre.format {font-family: inherit}
pre.menu-comment {font-family: serif}
pre.menu-preformatted {font-family: serif}
pre.smalldisplay {font-family: inherit; font-size: smaller}
pre.smallexample {font-size: smaller}
pre.smallformat {font-family: inherit; font-size: smaller}
pre.smalllisp {font-size: smaller}
span.nolinebreak {white-space: nowrap}
span.roman {font-family: initial; font-weight: normal}
span.sansserif {font-family: sans-serif; font-weight: normal}
ul.no-bullet {list-style: none}
body {
margin: 2%;
padding: 0 5%;
background: #ffffff;
}
h1,h2,h3,h4,h5 {
font-weight: bold;
padding: 5px 5px 5px 5px;
background-color: #c2e0ff;
color: #336699;
}
h1 {
padding: 2em 2em 2em 5%;
color: white;
background: #336699;
text-align: center;
letter-spacing: 3px;
}
h2 { text-decoration: underline; }
pre {
margin: 0 5%;
padding: 0.5em;
}
pre.example,pre.verbatim {
padding-bottom: 1em;
border: solid #c2e0ff;
background: #f0faff;
border-width: 1px 1px 1px 5px;
margin: 1em auto;
width: 90%;
}
div.node {
margin: 0 -5% 0 -2%;
padding: 0.5em 0.5em;
margin-top: 0.5em;
margin-bottom: 0.5em;
font-weight: bold;
}
dd, li {
padding-top: 0.1em;
padding-bottom: 0.1em;
}
div.float {
margin-bottom: 0.5em;
text-align: center;
}
table {
text-align: left;
margin-left:auto;
margin-right:auto;
border-spacing: 7px;
width: 50%;
}
th {
padding: 0;
color: #336699;
background-color: #c2e0ff;
border: solid #000000;
border-width: 0px;
margin: 1em auto;
text-align: center;
margin-left:auto;
margin-right:auto;
}
td {
padding: 0;
border: solid #000000;
background-color: #f0faff;
border-width: 0px;
margin: 1em auto;
text-align: left;
margin-left:auto;
margin-right:auto;
padding-left: 1em;
}
dl {
text-align: left;
margin-left:auto;
margin-right:auto;
width: 50%;
padding-left: 1em;
border: solid #c2e0ff;
background: #f0faff;
border-width: 5px 1px 1px 1px;
margin: 1em auto;
}
-->
</style>
</head>
<body lang="en">
<a name="PKCS11-Initialization"></a>
<div class="header">
<p>
Next: <a href="PKCS11-Manual-Initialization.html#PKCS11-Manual-Initialization" accesskey="n" rel="next">PKCS11 Manual Initialization</a>, Up: <a href="Smart-cards-and-HSMs.html#Smart-cards-and-HSMs" accesskey="u" rel="up">Smart cards and HSMs</a> [<a href="index.html#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="Function-and-Data-Index.html#Function-and-Data-Index" title="Index" rel="index">Index</a>]</p>
</div>
<hr>
<a name="Initialization-1"></a>
<h4 class="subsection">5.3.1 Initialization</h4>
<p>To allow all <acronym>GnuTLS</acronym> applications to transparently access smart cards
and tokens, <acronym>PKCS</acronym> #11 is automatically initialized during the first
call of a <acronym>PKCS</acronym> #11 related function, in a thread safe way.
The default initialization process, utilizes p11-kit configuration, and loads any
appropriate <acronym>PKCS</acronym> #11 modules. The p11-kit configuration
files<a name="DOCF12" href="#FOOT12"><sup>12</sup></a> are typically stored in <code>/etc/pkcs11/modules/</code>.
For example a file that will instruct GnuTLS to load the <acronym>OpenSC</acronym> module,
could be named <code>/etc/pkcs11/modules/opensc.module</code> and contain the following:
</p>
<div class="example">
<pre class="example">module: /usr/lib/opensc-pkcs11.so
</pre></div>
<p>If you use these configuration files, then there is no need for other initialization in
<acronym>GnuTLS</acronym>, except for the PIN and token callbacks (see next section).
In several cases, however, it is desirable to limit badly behaving modules
(e.g., modules that add an unacceptable delay on initialization)
to single applications. That can be done using the “enable-in:” option
followed by the base name of applications that this module should be used.
</p>
<p>It is also possible to manually initialize or even disable the PKCS #11 subsystem if the
default settings are not desirable or not available (see <a href="PKCS11-Manual-Initialization.html#PKCS11-Manual-Initialization">PKCS11 Manual Initialization</a>
for more information).
</p>
<p>Note that, PKCS #11 modules behave in a peculiar way after a fork; they
require a reinitialization of all the used PKCS #11 resources.
While GnuTLS automates that process, there are corner cases where
it is not possible to handle it correctly in an automated way<a name="DOCF13" href="#FOOT13"><sup>13</sup></a>. For that, it is
recommended not to mix fork() and PKCS #11 module usage. It is recommended
to initialize and use any PKCS #11 resources in a single process.
</p>
<p>Older versions of <acronym>GnuTLS</acronym> required to call <a href="PKCS-11-API.html#gnutls_005fpkcs11_005freinit">gnutls_pkcs11_reinit</a>
after a fork() call; since 3.3.0 this is no longer required.
</p>
<div class="footnote">
<hr>
<h4 class="footnotes-heading">Footnotes</h4>
<h3><a name="FOOT12" href="#DOCF12">(12)</a></h3>
<p><a href="http://p11-glue.freedesktop.org/">http://p11-glue.freedesktop.org/</a></p>
<h3><a name="FOOT13" href="#DOCF13">(13)</a></h3>
<p>For
example when an open session is to be reinitialized, but the PIN is not available
to GnuTLS (e.g., it was entered at a pinpad).</p>
</div>
<hr>
<div class="header">
<p>
Next: <a href="PKCS11-Manual-Initialization.html#PKCS11-Manual-Initialization" accesskey="n" rel="next">PKCS11 Manual Initialization</a>, Up: <a href="Smart-cards-and-HSMs.html#Smart-cards-and-HSMs" accesskey="u" rel="up">Smart cards and HSMs</a> [<a href="index.html#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="Function-and-Data-Index.html#Function-and-Data-Index" title="Index" rel="index">Index</a>]</p>
</div>
</body>
</html>
|
