<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p>P11-glue list,</p>
<p>I am trying to include some Network Security Services (NSS)
functionality while also using "p11-kit-proxy", but (so far) I'm
unable to do so. In particular, I want to make NSS treat X.509
certificates on a smart card as public, so that the user can
access them without first providing a PIN for the card. I'm
hoping that someone on this list can provide some direction to me.</p>
<p>In the past, when not using "p11-kit-proxy", I could accomplish
adding a PKCS #11 module to the system database, and also making
the module treat the certificates as "public", by using a command
like:</p>
<blockquote>
<p><font face="monospace">$ modutil -add opensc -mechanisms
FRIENDLY -libfile /usr/lib64/pkcs11/opensc-pkcs.so -dbdir
sql:/etc/pki/nssdb</font></p>
</blockquote>
<p>where the command added the "opensc" library to the output of
"modutil -list" and where the "-mechanisms FRIENDLY" option added
an "NSS=" line to the file "/etc/pki/nssdb/pkcs11.txt" like:</p>
<blockquote>
<p><font face="monospace">library=opensc-pkcs11.so<br>
name=opensc<br>
NSS=slotParams={0x00000001=[slotFlags=PublicCerts ]
0x00000002=[slotFlags=PublicCerts ] }<br>
</font></p>
</blockquote>
<p>With this configuration, when I execute a "certutil" command to
manipulate certificates, the command provides a response without
first prompting for a PIN for the token.<br>
</p>
<p>However, when my system is using "p11-kit-proxy", the module
entry of "opensc" no longer appears in the output of "modutil
-list"; instead the entry is "p11-kit-proxy". How would I
configure "p11-kit-proxy" to pass along the "PublicCerts" setting
to the module(s) for which it is the proxy?<br>
</p>
<p>Would I add a name/value pair to the file
"/usr/share/p11-kit/modules/opensc.module"? If so, what
name/value pair? (I'm actually not using the OpenSC module, but
another PKCS #11 module.)</p>
<p>I have tried directly editing the files of
"/etc/pki/nssdb/pkcs11.txt" and
"/etc/crypto-policies/back-ends/nss.config" to add the "NSS=..."
line, but "certutil" still prompts for a PIN.<br>
</p>
<p>Thanks for any suggestions,<br>
-- Steve Ross<br>
</p>
</body>
</html>