Most of what people want from an HSM on the command line is OpenSSL with the key somewhere OpenSSL cannot read. That works, and the only real decision is which of two mechanisms you use.
pkcs11-provider on OpenSSL 3, engine_pkcs11 before it
OpenSSL 3 replaced engines with providers. The current route is pkcs11-provider, which exposes the token’s keys as ordinary OpenSSL keys addressed by URI. On OpenSSL 1.1.1 and older tooling you will find engine_pkcs11 from libp11 instead, doing the same job through the older interface. Both are packaged by the usual distributions and neither is ours.
Either way the underlying library is OpenSC’s opensc-pkcs11, which is the same module every other tool on this site uses.
Keys are addressed by URI, not by path
A PKCS#11 URI names the token and the object, so nothing in your command line implies a file that could exist:
pkcs11:token=KeyNub;object=my-ca;type=private
Generate the key on the card with pkcs11-tool --keypairgen, then produce a certificate request against it with openssl req -new pointing at that URI. The private key never appears in the process, so there is no -keyout file to protect, forget, or find in your shell history a year later.
The same URIs work in nginx, Apache and HAProxy configuration, which is what makes TLS server keys practical without patching anything.
Two things that trip people up
Address the slot by label. Slot indices are assigned in the order readers appear and will move when something else is plugged in. Every tool here accepts a token label; use it.
Watch what needs the PIN. Public operations do not, private ones do, and a script that prompts interactively will hang in a cron job. Decide deliberately how the user PIN reaches the process, and remember the card enforces its own retry counter — a loop that retries a wrong PIN will lock the token, and nothing on the host can roll that counter back.
Where to go next
OpenSSL is the lowest-level way in, and the one worth learning first. See also TLS server keys, running your own CA, EJBCA, or the hardware security module overview and the datasheet.
The KeyNub HSM ships from Munich. Ask us if you want to talk through a deployment first, or order one.
