NSS loads p11-kit modules by default
Fedora provides a mechanism to configure PKCS#11 modules system wide, allowing crypto libraries (GnuTLS and OpenSSL) to use PKCS#11 modules in a consistent manner.
Until now, NSS applications haven’t benefited from it as NSS uses a different configuration mechanism which requires users to register PKCS#11 modules in NSS databases.
Fedora 29 makes this manual procedure unnecessary by registering the
p11-kit-proxy module (system PKCS#11 module aggregator) in NSS databases with the default configuration.
This allows NSS applciations to use PKCS#11 modules the same as other crypto libraries, enabling consistency in PKCS#11 driver registration across the system.
Consequently, users will see improvements in smart card and hardware security module (HSM) use in Fedora.
Want to help? Learn how to contribute to Fedora Docs ›