I’mt trying to get a setup with two Nitrokeys HSM automated. HSM A contains the “root” key and is locked by a 2-of-3 scheme. Currently I’m trying to setup openssl with PKCS11. pkcs11-tool only detects the first key / slot on the device (–list-slots). Is there any way pkcs11-tool finds all keys? …

Did you try to setup hte HSM using the SmartCardShell ?

Yes that works. Including the SCSH3gui - But as far as I understand that software can not create or sign certificates.

[image] 3blabs: pkcs11-tool only detects the first key / slot on the device (–list-slots). This is correct. One Nitrokey HSM is one slot. So --list-slots should show one entry for your Nitrokey HSM. You can use the slot number in the further commands if you have multiple devices attached. …

Nitrokey Support

PKCS11 / OpenSSL and n-of-m

Nitrokeys HSM

sc-hsm August 1, 2026, 8:03pm 5

See Nitrokey HSM, n-of-m scheme and XCA - #3 by sc-hsm