Re: Signing an x509 Certificate Signing Request (CSR) with a smart card

--===============6115698637837275696==
Content-Type: multipart/alternative; boundary="000000000000fe99f8063abea43f"

--000000000000fe99f8063abea43f
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello Lars,

I think you can sign a CSR with certtool, the command might look something
like this:
*$ certtool --generate-certificate --load-request=3D<request.csr>
--load-ca-privkey=3D<privatekey.key> --load-ca-certificate=3D<ca.crt>
--outfile=3D<cert.pem>*
but instead of providing file paths, you can provide PKCS#11 URIs which
would look something like this
"pkcs11:p11-kit-trust;manufacturer=3DPKCS%2311%20Kit;serial=3D1;token=3DSys=
tem%20Trust".
You can specify the concrete cert and keys by adding type,id and label to
the uri, so maybe something
like: "pkcs11:p11-kit-trust;manufacturer=3DPKCS%2311%20Kit;serial=3D1;token=
=3DSystem%20Trust;type=3D<OBJECT_TYPE>;object=3D<LABEL>;id=3D<ID>".
You can learn more about PKCS#11 URIs in RFC7512. If the PIN is required
for URI access you can provide it by using the environment variables
GNUTLS_PIN and GNUTLS_SO_PIN.
Hopefully this is helpful.

Regards,
Zoltan

On Tue, Jul 22, 2025 at 11:20=E2=80=AFAM Lars Nood=C3=A9n <lars.nooden@gmx.=
com> wrote:

> Hello,
>
> I have a smart card which contains 1) an authentication and encryption
> certificate, plus a matching private key, and 2) a signature
> certificate, plus a matching private key.
>
> The card (or at least its reader) is seen by the GnuTLS PKCS #11 tool,
> but that is as far as I get, in part due to a PIN and in part due to my
> ignorance on the topic:
>
> $ p11tool --list-tokens
> Token 0:
>         URL:
>
> pkcs11:model=3Dp11-kit-trust;manufacturer=3DPKCS%2311%20Kit;serial=3D1;to=
ken=3DSystem%20Trust
>         Label: System Trust
>         Type: Trust module
>         Flags: uPIN uninitialized
>         Manufacturer: PKCS#11 Kit
>         Model: p11-kit-trust
>         Serial: 1
>         Module: p11-kit-trust.so
>
> What I would like to do is use this card to sign a CSR (x509
> Certificate Signing Request) file using the card's private signing key.
>
> I presume that is right up GnuTLS' alley.  I am grateful for any help,
> advice, or pointers in that direction.
>
> /Lars
>
> PS.  Context:
>
> $ apt-cache policy gnutls-bin | head -n 2
> gnutls-bin:
>    Installed: 3.8.3-1.1ubuntu3.4
>
> $ lsb_release -rd
> No LSB modules are available.
> Description:    Linux Mint 22.1
> Release:        22.1
>
> $ uname -srm
> Linux 6.8.0-64-generic x86_64
>
> _______________________________________________
> Gnutls-help mailing list
> [email protected]
> http://lists.gnupg.org/mailman/listinfo/gnutls-help
>
>

--000000000000fe99f8063abea43f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hello Lars,</div><div><br></div><div>I think you can =
sign a CSR with certtool, the command might look something like this:</div>=
<div><i>$ certtool --generate-certificate --load-request=3D&lt;request.csr&=
gt; --load-ca-privkey=3D&lt;privatekey.key&gt; --load-ca-certificate=3D&lt;=
ca.crt&gt; --outfile=3D&lt;cert.pem&gt;</i></div><div>but instead of provid=
ing file paths, you can provide PKCS#11 URIs which would look something lik=
e this &quot;pkcs11:p11-kit-trust;manufacturer=3DPKCS%2311%20Kit;serial=3D1=
;token=3DSystem%20Trust&quot;. You can specify the concrete cert and keys b=
y adding type,id and label to the uri, so maybe something like:=C2=A0&quot;=
pkcs11:p11-kit-trust;manufacturer=3DPKCS%2311%20Kit;serial=3D1;token=3DSyst=
em%20Trust;type=3D&lt;OBJECT_TYPE&gt;;object=3D&lt;LABEL&gt;;id=3D&lt;ID&gt=
;&quot;. You can learn more about PKCS#11 URIs in RFC7512.=C2=A0If the PIN =
is required for URI access you can provide it by using the environment vari=
ables GNUTLS_PIN and GNUTLS_SO_PIN.</div><div>Hopefully this is helpful.</d=
iv><div><br></div><div>Regards,</div><div>Zoltan</div></div><br><div class=
=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr=
">On Tue, Jul 22, 2025 at 11:20=E2=80=AFAM Lars Nood=C3=A9n &lt;<a href=3D"=
mailto:[email protected]">[email protected]</a>&gt; wrote:<br></div><bl=
ockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-lef=
t:1px solid rgb(204,204,204);padding-left:1ex">Hello,<br>
<br>
I have a smart card which contains 1) an authentication and encryption <br>
certificate, plus a matching private key, and 2) a signature <br>
certificate, plus a matching private key.<br>
<br>
The card (or at least its reader) is seen by the GnuTLS PKCS #11 tool, <br>
but that is as far as I get, in part due to a PIN and in part due to my <br=
>
ignorance on the topic:<br>
<br>
$ p11tool --list-tokens<br>
Token 0:<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 URL: <br>
pkcs11:model=3Dp11-kit-trust;manufacturer=3DPKCS%2311%20Kit;serial=3D1;toke=
n=3DSystem%20Trust<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Label: System Trust<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Type: Trust module<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Flags: uPIN uninitialized<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Manufacturer: PKCS#11 Kit<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Model: p11-kit-trust<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Serial: 1<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Module: p11-kit-trust.so<br>
<br>
What I would like to do is use this card to sign a CSR (x509 <br>
Certificate Signing Request) file using the card&#39;s private signing key.=
<br>
<br>
I presume that is right up GnuTLS&#39; alley.=C2=A0 I am grateful for any h=
elp, <br>
advice, or pointers in that direction.<br>
<br>
/Lars<br>
<br>
PS.=C2=A0 Context:<br>
<br>
$ apt-cache policy gnutls-bin | head -n 2<br>
gnutls-bin:<br>
=C2=A0 =C2=A0Installed: 3.8.3-1.1ubuntu3.4<br>
<br>
$ lsb_release -rd<br>
No LSB modules are available.<br>
Description:=C2=A0 =C2=A0 Linux Mint 22.1<br>
Release:=C2=A0 =C2=A0 =C2=A0 =C2=A0 22.1<br>
<br>
$ uname -srm<br>
Linux 6.8.0-64-generic x86_64<br>
<br>
_______________________________________________<br>
Gnutls-help mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">Gnutls-he=
[email protected]</a><br>
<a href=3D"http://lists.gnupg.org/mailman/listinfo/gnutls-help" rel=3D"nore=
ferrer" target=3D"_blank">http://lists.gnupg.org/mailman/listinfo/gnutls-he=
lp</a><br>
<br>
</blockquote></div>

--000000000000fe99f8063abea43f--



--===============6115698637837275696==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Gnutls-help mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnutls-help

--===============6115698637837275696==--