Normally, I use my PKCS#11 card to logon to a secured site using a browser plugin which initiated a local software dialog to input PKI card PIN.

Is it anyhow possible to do the following?

  • Run some console tool
  • Tool ideally asks for PIN directly or at least triggers the standard dialog
  • Auth information can be submitted to the secure location site

I have tried so far OpenSC but it says the card is not supported.

This question focuses on how to perform the auth part with the PKI card, not how to use the API of the secured site.


Some findings so far based on @phl's answer.

To check for functions offered by the card's driver, I did the following.

# explore Debian package of the driver installer
dpkg -c <filename>.deb | grep .so

# list functions offered by the library and search for the target function
nm -D <library> | grep C_GetFunctionList

Here it was!

<hexvalue> T C_GetFunctionList

Then, I have tried to call this function from Python/ctypes.

from ctypes import *
cardfun1 = cdll.LoadLibrary("xxxxyyy.so")

And the output is: 7. What then?!

Also, my impression is that is should be somehow possible to combine OpenSSL with the driver but in examples I can find so far people use the card to store the SSH key.


While OpenSSL is not possible with this card (no exported function bind_engine), with PyKCS11 it is anyway possible to use card's PIN and call its security functions. So the hint by @phl is the answer.

session = pkcs11.openSession(slot, CKF_SERIAL_SESSION | CKF_RW_SESSION)

2 Answers 2


If your smart card supports PKCS#11, you have a PKCS#11 library/smartcard driver for your card. This library must export the PKCS#11 C_GetFunctionList function. You can link the library to the command line tool you want to develop and use the PKCS#11 API (PKCS#11 standard) to perform the authentication.

  • "export function.. link library" ..this sounds like C development? If I'd be able to find that driver library file, how would I test test that it links and the function is there?
    – J. Doe
    Oct 25, 2018 at 10:50
  • @phil, I have found the exported function and I think linked the library in Python. Please share where to go from there.
    – J. Doe
    Oct 25, 2018 at 15:35
  • 1
    try the Python PKCs#11 wrapper PyKCS11. With this python module you can load the library and use the PKCS#11 function through the provided python api. In C you would call the following functions C_GetFunctionList, C_Initialize, C_GetSlotList, C_OpenSession, C_Login
    – phl
    Oct 25, 2018 at 16:21
  • 1
    @J. Doe OpenSSL: maybe you can use the library also as openssl engine. If so the library should export a function called bind_engine. You can try to load the library as openssl engine with openssl engine -c -t path-to-the-lib
    – phl
    Oct 25, 2018 at 17:15
  • these are very helpful hints. Though, openssl is not possible as the function bind_engine is absent, but pykcs11 is what I will investigate. Thank you very much!
    – J. Doe
    Oct 26, 2018 at 11:19

Your question is a bit shallow, but yes, it is possible, but you'll probably have to code that yourself.

Depending on site you are using, you might get lucky and find some github repo of someone who already figured out how to auth for that site through the CLI.

If you are on Linux/Mac, take a look at gnuPG, pinentry and cURL. Using your scripting language of choice you'll be able to hack something together to create the appropriate request to the webserver for authorisation.

  • thank you; I have extended more details; my problem is as it seems to me more the card than the site.
    – J. Doe
    Oct 24, 2018 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.