pkcs11-keygen — generate RSA keys on a PKCS#11 device
pkcs11-keygen [-P] [-m ] [module-s ] [slot-e] {-b keysize} {-l label} [-i ] [id-p ]PIN
pkcs11-keygen causes a PKCS#11 device to generate
a new RSA key pair with the specified label and
with keysize bits of modulus.
Set the new private key to be non-sensitive and extractable. The allows the private key data to be read from the PKCS#11 device. The default is for private keys to be sensitive and non-extractable.
moduleSpecify the PKCS#11 provider module. This must be the full path to a shared library object implementing the PKCS#11 API for the device.
slotOpen the session with the given PKCS#11 slot. The default is slot 0.
Use a large exponent.
keysize
Create the key pair with keysize bits of
modulus.
labelCreate key objects with the given label. This name must be unique.
idCreate key objects with id. The id is either an unsigned short 2 byte or an unsigned long 4 byte number.
PINSpecify the PIN for the device. If no PIN is provided on the command line, pkcs11-keygen will prompt for it.