4

I am using p11tool on CentOS to read a PIV smart card. The card is being read via the coolkey package driver (using libcoolkeypk11.so, per p11-kit list-modules)

I can get a listing of the certs on there using 

p11tool --list-all-certs 'pkcs11:model=;manufacturer=;serial=;token=CoolKey'

The list of certs only includes the URL, Type, Label, and ID. Using the GUI Smart Card Manager from the RedHat Enterprise Security Client (esc package, which requires coolkey (not opensc)), I can drill down to view certificate details, like the cert's serial number and fingerprints.

I tried p11tool --info <certurl> hoping that would provide the details, but that still only lists the four fields seen with --list-all-certs.

UPDATE: I also tried openssl x509 -engine pkcs11 -keyform engine -text -in <certurl> but that failed, with the message

140067620280208:error:02001002:system library:fopen:No such file or directory:bss_file.c:402:fopen('<certurl>','r')

How can I view those details using p11tool and/or other command line tools?

Improve this question
3
  • 1
    The openssl tool expects a file as parameter after the -in switch. You should export the certificate from the smart card into a file.
    – Johan Myréen
    Commented Oct 6, 2018 at 5:50
  • 2
    You need to have opensc installed, which gives you pkcs15-tool amongst others. Use it with the --list-certificates and --list-certificate <id> options.
    – garethTheRed
    Commented Oct 6, 2018 at 6:56
  • @garerthTheRed. Thanks - Centos is still using coolkey, not opensc. I'll need to look at whether installing opensc will create any conflicts or problems.
    – Randall
    Commented Oct 9, 2018 at 16:06

1 Answer 1

Reset to default
4

Using the --export flag was the key (Thanks for the tip, @Johan Myréen). Thus, to see the cert's details and fingerprints, this works:

p11tool --export <certurl> | openssl x509 -text -noout

p11tool --export <certurl> | openssl x509 -fingerprint -noout #defaults to SHA1 fingerprint

p11tool --export <certurl> | openssl x509 -fingerprint -noout -md5 #for MD5 fingerprint

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .