Cybersecurity Made in Canada™
CSMIC

Security Tools › PKI & Certificates › HSM & PKCS#11

HSM and PKCS#11

Build and parse PKCS#11 URIs (RFC 7512), decode the CKR, CKM and CKA codes in your logs, and review the attributes of an HSM key template before you generate keys.

  • 3 free tools
  • Nothing uploaded or stored
  • PKCS#11 · RFC 7512

HSM & PKCS#11

Hardware security modules keep CA and signing keys inside tamper-resistant hardware. PKCS#11 (Cryptoki) is the standard API to use them.

PKCS#11 URI builder & parser RFC 7512

PKCS#11 is the standard interface to HSMs, smart cards and tokens. Browsers cannot talk to tokens directly, but most tools (OpenSSL 3, p11-kit, GnuTLS, many HSM SDKs) identify keys with a pkcs11: URI. Build one here, or paste one to read it.

Build

There is deliberately no field for pin-value: PINs should not travel inside URIs.

Parse

Example: openssl pkeyutl -sign -provider pkcs11 -inkey "pkcs11:object=web-signing-key;type=private" …

PKCS#11 code lookup CKR · CKM · CKA New

Got CKR_0x000000A0 in a log? Decode PKCS#11 return codes, mechanisms and attributes by number or name, with what to check next.

Values follow the OASIS PKCS #11 v2.40/3.0 specifications. Codes from 0x80000000 are vendor-defined — see your HSM vendor's header files.

HSM key-template review New

Tick the attributes you set when generating a private or secret key on your HSM. The review flags settings that weaken key protection.

FIPS 140-3 security levels at a glance

Level 1Production-grade algorithms; no physical security requirements.
Level 2Tamper evidence and role-based operator authentication.
Level 3Tamper resistance and response, identity-based authentication, protected key entry.
Level 4Complete protection envelope and environmental-failure protection.

Public and high-assurance CAs generally keep their keys in HSMs validated to FIPS 140-2/140-3 Level 3 or higher. Check a module's certificate in NIST's CMVP list.

Every tool runs in your browser. See all tools by category.

Certificate decoderCertificates, CSRs and CRLs, field by field. Certificate TransparencyCT log search and SCT checks for your domain. Chains, keys and ASN.1Validate chains, match keys, read ASN.1 and OIDs. Create and convertKeys, CSRs, dev certificates and conversions. Signatures and CMSAnalyse and create CMS / PKCS#7 signatures. ACME test runnerLive RFC 8555 checks against ACME CAs. SCEP test runnerGrade a SCEP exchange step by step. Protocols and APIsOCSP, EST, CAA and how they fit together. Post-quantum labML-KEM, ML-DSA and SLH-DSA, live. Learn and exploreX.509 anatomy, a certificate globe and lookups.