--- product: Chilkat product_version: 11.7.0 language: pascal language_label: Lazarus Pascal class: Pkcs11 license: bundle deprecated: false reference_html: https://www.chilkatsoft.com/refdoc/pascal_Pkcs11Ref.html --- # Chilkat Pkcs11 — Lazarus Pascal — v11.7.0 > Chilkat 11.7.0 · language=pascal · class=Pkcs11 > Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0//classes/Pkcs11.md`. > Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/guide.md`. ## Purpose **Work directly with PKCS#11 smart cards, USB tokens, and HSMs.** `Chilkat.Pkcs11` is the direct Chilkat interface for working with PKCS#11 devices such as smart cards, USB tokens, and hardware security modules. It manages the vendor PKCS#11 shared library, slot and token discovery, session opening, PIN login, certificate and key discovery, object attributes, key generation, key import, object creation and deletion, public-key export, and token administration. **Load vendor libraries** Initialize access to the PKCS#11 module supplied by the smart-card, token, or HSM vendor. **Discover slots and tokens** Enumerate available slots, detect inserted tokens, and inspect token or slot information before opening a session. **Open sessions and login** Open PKCS#11 sessions, login with a user PIN, perform private-key operations, then logout and close the session. **Find certs and keys** Search for certificates, public keys, private keys, and other token objects using labels, IDs, classes, attributes, or key relationships. **Create and manage objects** Generate keys, import keys, create token objects, inspect attributes, and delete objects when supported by the token policy. **Use with signing classes** Link a token-backed certificate or private key to other Chilkat classes so signing can occur without the private key leaving the device. **Common pattern:** Load the vendor PKCS#11 library, select the slot or token, open a session, login with the PIN, find the certificate that has the needed private key, link that certificate for use by another Chilkat signing class, then logout and close the session. Use `Pkcs11` when the application needs direct token control; use `Chilkat.Cert` once a token-backed certificate has been selected for signing or authentication. For an extended overview, see [Pkcs11 Class Overview](https://www.chilkatsoft.com/pkcs11_class_overview.asp). ## Object creation, unlocking and error handling **Create / Free** ```pascal uses Chilkat.Pkcs11; var obj: TPkcs11; begin obj := TPkcs11.Create; try if not obj.IsValid then raise Exception.Create('Failed to create a TPkcs11 instance.'); // ... use obj ... finally obj.Free; end; end; ``` `constructor Create;` Allocates the underlying CkPkcs11 object and returns a new TPkcs11 instance. Simply adding **Chilkat.Pkcs11** to the unit's `uses` clause is enough to locate and bind to the Chilkat shared library (DLL / .so / .dylib) at runtime — no separate load step is required. Check `obj.IsValid` after calling `Create`; it is `False` if the underlying library could not be found/loaded or the object could not be allocated (for example, when unlicensed). `destructor Destroy; override;` Every TPkcs11 created by calling `Create` should eventually be released by calling `.Free` (inherited from `TObject`). The destructor automatically disposes the underlying CkPkcs11 handle. A native (unmanaged) memory leak occurs if the object is never freed. Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Lazarus Pascal. ## Members common to every Chilkat class Documented once per language in `common-members.md`; listed here so this page is self-contained. | Property | Signature | Access | Meaning | |---|---|---|---| | `DebugLogFilePath` | `property DebugLogFilePath: string read GetDebugLogFilePath write SetDebugLogFilePath;` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. | | `LastErrorHtml` | `property LastErrorHtml: string read GetLastErrorHtml;` | read-only | Provides HTML-formatted information about the last called method or property. | | `LastErrorText` | `property LastErrorText: string read GetLastErrorText;` | read-only | Provides plain text information about the last called method or property. | | `LastErrorXml` | `property LastErrorXml: string read GetLastErrorXml;` | read-only | Provides XML-formatted information about the last called method or property. | | `LastMethodSuccess` | `property LastMethodSuccess: Boolean read GetLastMethodSuccess write SetLastMethodSuccess;` | read/write | Indicates the success or failure of the most recent method call: `True` means success, `False` means failure. | | `VerboseLogging` | `property VerboseLogging: Boolean read GetVerboseLogging write SetVerboseLogging;` | read/write | If set to `True`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. | | `Version` | `property Version: string read GetVersion;` | read-only | Version of the component/library, such as "10.1.0" | ## Member index | Member | Kind | Signature | |---|---|---| | `NumCerts` | property, read-only | `property NumCerts: Integer read GetNumCerts;` | | `SharedLibPath` | property, read/write | `property SharedLibPath: string read GetSharedLibPath write SetSharedLibPath;` | | `SigContextPin` | property, read/write | `property SigContextPin: string read GetSigContextPin write SetSigContextPin;` | | `UncommonOptions` | property, read/write | `property UncommonOptions: string read GetUncommonOptions write SetUncommonOptions;` | | `CloseSession` | method | `function CloseSession: Boolean;` | | `CreatePkcs11Object` | method | `// attrs is a TJsonObject object. function CreatePkcs11Object(attrs: TChilkatBase): LongWord;` | | `DestroyObject` | method | `function DestroyObject(hObject: LongWord): Boolean;` | | `Discover` | method | `// json is a TJsonObject object. function Discover(onlyTokensPresent: Boolean;     json: TChilkatBase): Boolean;` | | `ExportPublicKey` | method | `// pubKey is a TPublicKey object. function ExportPublicKey(keyHandle: LongWord;     pubKey: TChilkatBase): Boolean;` | | `FindAllCerts` | method | `function FindAllCerts: Boolean;` | | `FindAllKeys` | method | `// json is a TJsonObject object. function FindAllKeys(const keyClass: string;     json: TChilkatBase): Boolean;` | | `FindCert` | method | `// cert is a TCert object. function FindCert(const certPart: string;     const partValue: string;     cert: TChilkatBase): Boolean;` | | `FindObject` | method | `// jsonTemplate is a TJsonObject object. function FindObject(jsonTemplate: TChilkatBase): LongWord;` | | `GenEcKey` | method | `// publicAttrs is a TJsonObject object. // privateAttrs is a TJsonObject object. // jsonOut is a TJsonObject object. // pubKey is a TPublicKey object. function GenEcKey(publicAttrs: TChilkatBase;     privateAttrs: TChilkatBase;     jsonOut: TChilkatBase;     pubKey: TChilkatBase): Boolean;` | | `GenRsaKey` | method | `// publicAttrs is a TJsonObject object. // privateAttrs is a TJsonObject object. // jsonOut is a TJsonObject object. // pubKey is a TPublicKey object. function GenRsaKey(publicAttrs: TChilkatBase;     privateAttrs: TChilkatBase;     jsonOut: TChilkatBase;     pubKey: TChilkatBase): Boolean;` | | `GenSecretKey` | method | `// jsonTemplate is a TJsonObject object. function GenSecretKey(const keyType: string;     jsonTemplate: TChilkatBase): LongWord;` | | `GetCert` | method | `// cert is a TCert object. function GetCert(index: Integer;     cert: TChilkatBase): Boolean;` | | `ImportPrivateKey` | method | `// privKey is a TPrivateKey object. // jsonTemplate is a TJsonObject object. function ImportPrivateKey(privKey: TChilkatBase;     jsonTemplate: TChilkatBase): LongWord;` | | `ImportSshKey` | method | `// sshKey is a TSshKey object. // jsonTemplate is a TJsonObject object. function ImportSshKey(sshKey: TChilkatBase;     jsonTemplate: TChilkatBase): LongWord;` | | `Initialize` | method | `function Initialize: Boolean;` | | `InitPin` | method | `function InitPin(const pin: string): Boolean;` | | `InitToken` | method | `function InitToken(slotId: Integer;     const pin: string;     const tokenLabel: string): Boolean;` | | `Login` | method | `function Login(userType: Integer;     const pin: string): Boolean;` | | `Logout` | method | `function Logout: Boolean;` | | `OpenSession` | method | `function OpenSession(slotId: Integer;     readWrite: Boolean): Boolean;` | | `QuickSession` | method | `function QuickSession(userType: Integer;     const pin: string): Boolean;` | | `SetPin` | method | `function SetPin(const oldPin: string;     const newPin: string): Boolean;` | ## Properties ### Pkcs11.NumCerts `Chilkat 11.7.0 · pascal · Pkcs11 · NumCerts · property · read-only · since 9.5.0.88` ```pascal property NumCerts: Integer read GetNumCerts; ``` The number of certificates contained on the smart card or USB token. This property is set when FindAllCerts is called. ### Pkcs11.SharedLibPath `Chilkat 11.7.0 · pascal · Pkcs11 · SharedLibPath · property · read/write · since 9.5.0.88` ```pascal property SharedLibPath: string read GetSharedLibPath write SetSharedLibPath; ``` On Windows systems, then should be set to the name of the DLL file (if the DLL is located in C:\\Windows\\System32), or it can be the full path to the DLL. On Linux, MacOSX, or other non-Windows systems, this can also be either the full path to the .so or .dylib, or just the .so or .dylib filename. On these systems, Chilkat calls the [https://man7.org/linux/man-pages/man3/dlopen.3.html>dlopen system function](%3Ccode) to load the shared library. If just the filename is passed in, the directories searched are those indicated in the dlopen function description at ### Pkcs11.SigContextPin `Chilkat 11.7.0 · pascal · Pkcs11 · SigContextPin · property · read/write · since 9.5.0.97` ```pascal property SigContextPin: string read GetSigContextPin write SetSigContextPin; ``` If the smart card or token requires a signature context login within the signing operation, then set this property to the context-specific signature PIN. Most smart cards do not need this. Don't set this property unless you know for sure your smart card needs it. ### Pkcs11.UncommonOptions `Chilkat 11.7.0 · pascal · Pkcs11 · UncommonOptions · property · read/write · since 9.5.0.99` ```pascal property UncommonOptions: string read GetUncommonOptions write SetUncommonOptions; ``` This is a catch-all property to be used for uncommon needs. This property defaults to the empty string. It can be set to a list of one or more of the following comma separated keywords: - **Pkcs11DiscoverSkipTokenInfo** - Introduced in v9.5.0.99. Applies to the Discover method. If this keyword is present, then Discover will only return the slot information and will not make potentially time-consuming calls to get TokenInfo or information about supported mechanisms. - **Pkcs11DiscoverSkipMechanisms** - Introduced in v9.5.0.99. Applies to the Discover method. If this keyword is present, then Discover will get slot and token info, but will not make potentially time-consuming calls to get information about supported mechanisms. ## Methods ### Pkcs11.CloseSession `Chilkat 11.7.0 · pascal · Pkcs11 · CloseSession · method · since 9.5.0.88` ```pascal function CloseSession: Boolean; ``` Closes the session on the token (i.e. smart card). Note: Memory leaks can occur if the session is not properly closed. Returns True for success, False for failure. ### Pkcs11.CreatePkcs11Object `Chilkat 11.7.0 · pascal · Pkcs11 · CreatePkcs11Object · method · since 9.5.0.96` ```pascal // attrs is a TJsonObject object. function CreatePkcs11Object(attrs: TChilkatBase): LongWord; ``` Creates an object and returns the handle. The `attrs` specifies the attributes that define the object to be created. See the linked examples below for more information. ### Pkcs11.DestroyObject `Chilkat 11.7.0 · pascal · Pkcs11 · DestroyObject · method · since 9.5.0.96` ```pascal function DestroyObject(hObject: LongWord): Boolean; ``` Destroys an object (deletes it from the HSM). `hObject` is the object's handle. Returns True for success, False for failure. ### Pkcs11.Discover `Chilkat 11.7.0 · pascal · Pkcs11 · Discover · method · since 9.5.0.88` ```pascal // json is a TJsonObject object. function Discover(onlyTokensPresent: Boolean;     json: TChilkatBase): Boolean; ``` Discovers the readers, smart cards, and USB tokens accessible via PKCS11 on the computer (using the DLL/shared lib specified by SharedLibPath). The `onlyTokensPresent` specifies if only slots (readers) with tokens (smart cards) present should be returned. The information is written to the `json`. (For details, see the example below.) Returns True for success, False for failure. ### Pkcs11.ExportPublicKey `Chilkat 11.7.0 · pascal · Pkcs11 · ExportPublicKey · method · since 9.5.0.96` ```pascal // pubKey is a TPublicKey object. function ExportPublicKey(keyHandle: LongWord;     pubKey: TChilkatBase): Boolean; ``` Export a public key given a public or private key handle. The `pubKey` is loaded with the exported public key. See the example linked below for more details. Returns True for success, False for failure. ### Pkcs11.FindAllCerts `Chilkat 11.7.0 · pascal · Pkcs11 · FindAllCerts · method · since 9.5.0.88` ```pascal function FindAllCerts: Boolean; ``` Finds all certificates contained on the smart card (or USB token). This sets the NumCerts property. Each certificate can be obtained by calling GetCert(index) where the 1st cert is at index 0. Important: Private keys will not be seen unless the PKCS11 session is authenticated. To authenticate, your application must call Login after calling OpenSession. Returns True for success, False for failure. ### Pkcs11.FindAllKeys `Chilkat 11.7.0 · pascal · Pkcs11 · FindAllKeys · method · since 9.5.0.96` ```pascal // json is a TJsonObject object. function FindAllKeys(const keyClass: string;     json: TChilkatBase): Boolean; ``` Finds all keys contained on the smart card (or USB token). The `keyClass` indicates the kind of keys to return, and can be one of the following: - public - private - secret - otp Information about the keys is returned in `json`. Important: Private keys will not be seen unless the PKCS11 session is authenticated. To authenticate, your application must call Login after calling OpenSession. Returns True for success, False for failure. ### Pkcs11.FindCert `Chilkat 11.7.0 · pascal · Pkcs11 · FindCert · method · since 9.5.0.88` ```pascal // cert is a TCert object. function FindCert(const certPart: string;     const partValue: string;     cert: TChilkatBase): Boolean; ``` Finds the certificate where the given `certPart` equals the `partValue`. Possible values for `certPart` are: `privateKey`, `subjectDN`, `subjectDN_withTags`, `subjectCN`, `serial`, or `serial:issuerCN`. If `certPart` equals `privateKey`, then pass an empty string in `partValue`. Specifying `privateKey` means to return the first certificate having a private key. The `cert` is loaded with the certificate if successful. Important: Private keys will not be seen unless the PKCS11 session is authenticated. To authenticate, your application must call Login after calling OpenSession. Note: If successful, the `cert` will be linked internally with this PKCS11 session such that certificate can be used for signing on the smart card when used in other Chilkat classes such as XmlDSigGen, Pdf, Crypt2, Mime, MailMan, etc. Returns True for success, False for failure. ### Pkcs11.FindObject `Chilkat 11.7.0 · pascal · Pkcs11 · FindObject · method · since 9.5.0.96` ```pascal // jsonTemplate is a TJsonObject object. function FindObject(jsonTemplate: TChilkatBase): LongWord; ``` General function for finding an object such as a private key. Returns the handle of the first matching object, or 0 if not found. ### Pkcs11.GenEcKey `Chilkat 11.7.0 · pascal · Pkcs11 · GenEcKey · method · since 9.5.0.96` ```pascal // publicAttrs is a TJsonObject object. // privateAttrs is a TJsonObject object. // jsonOut is a TJsonObject object. // pubKey is a TPublicKey object. function GenEcKey(publicAttrs: TChilkatBase;     privateAttrs: TChilkatBase;     jsonOut: TChilkatBase;     pubKey: TChilkatBase): Boolean; ``` Generate an EC key pair suitable for signing data and verifying signatures. The private key is created on the HSM (smart card or token), and the public key is returned in `pubKey`. The `publicAttrs` and `privateAttrs` contain attributes for the public and private keys respectively. The PKCS11 public and private key handles are returned in `jsonOut`. Handles are used to reference a PKCS11 object, such as a public or private key, and are valid during the PKCS11 session. To use the key in future PKCS11 sessions, your application would need to find the object to get a new handle. See the example linked below for more details. Returns True for success, False for failure. ### Pkcs11.GenRsaKey `Chilkat 11.7.0 · pascal · Pkcs11 · GenRsaKey · method · since 9.5.0.96` ```pascal // publicAttrs is a TJsonObject object. // privateAttrs is a TJsonObject object. // jsonOut is a TJsonObject object. // pubKey is a TPublicKey object. function GenRsaKey(publicAttrs: TChilkatBase;     privateAttrs: TChilkatBase;     jsonOut: TChilkatBase;     pubKey: TChilkatBase): Boolean; ``` Generate an RSA key pair suitable for signing data and verifying signatures. The private key is created on the HSM (smart card or token), and the public key is returned in `pubKey`. The `publicAttrs` and `privateAttrs` contain attributes for the public and private keys respectively. The PKCS11 public and private key handles are returned in `jsonOut`. Handles are used to reference a PKCS11 object, such as a public or private key, and are valid during the PKCS11 session. To use the key in future PKCS11 sessions, your application would need to find the object to get a new handle. See the example linked below for more details. Returns True for success, False for failure. ### Pkcs11.GenSecretKey `Chilkat 11.7.0 · pascal · Pkcs11 · GenSecretKey · method · since 9.5.0.96` ```pascal // jsonTemplate is a TJsonObject object. function GenSecretKey(const keyType: string;     jsonTemplate: TChilkatBase): LongWord; ``` Generates a symmetric encryption key. The `keyType` is the key type, which can be one of the following values: - AES - AES XTS - Blowfish - Twofish - ChaCha20 The `jsonTemplate` is a template that specifies attributes about the key to be generated. See the example at the link below. The handle to the generated key is returned. A value of 0 is returned on failure. ### Pkcs11.GetCert `Chilkat 11.7.0 · pascal · Pkcs11 · GetCert · method · since 9.5.0.88` ```pascal // cert is a TCert object. function GetCert(index: Integer;     cert: TChilkatBase): Boolean; ``` Loads `cert` with the Nth certificate indicated by `index`. The 1st certificate is at index 0. The FindAllCerts method must be called beforehand to load the certs from the smart card into this object. After calling FindAllCerts, the NumCerts property is set and each certificate can be retrieved by calling GetCert. Returns True for success, False for failure. ### Pkcs11.ImportPrivateKey `Chilkat 11.7.0 · pascal · Pkcs11 · ImportPrivateKey · method · since 9.5.0.96` ```pascal // privKey is a TPrivateKey object. // jsonTemplate is a TJsonObject object. function ImportPrivateKey(privKey: TChilkatBase;     jsonTemplate: TChilkatBase): LongWord; ``` Imports a private key onto the HSM. Returns the handle of the unwrapped key, or 0 if failed. See the linked example below for more details. ### Pkcs11.ImportSshKey `Chilkat 11.7.0 · pascal · Pkcs11 · ImportSshKey · method · since 9.5.0.96` ```pascal // sshKey is a TSshKey object. // jsonTemplate is a TJsonObject object. function ImportSshKey(sshKey: TChilkatBase;     jsonTemplate: TChilkatBase): LongWord; ``` Imports an SSH private key onto the HSM. Returns the handle of the unwrapped key, or 0 if failed. ### Pkcs11.Initialize `Chilkat 11.7.0 · pascal · Pkcs11 · Initialize · method · since 9.5.0.88` ```pascal function Initialize: Boolean; ``` Initializes the PKCS#11 library. Should be called after specifying the SharedLibPath. The DLL (or .so/.dylib) is dynamically loaded and the PKCS#11 lib is initialized. Returns True for success, False for failure. ### Pkcs11.InitPin `Chilkat 11.7.0 · pascal · Pkcs11 · InitPin · method · since 9.5.0.89` ```pascal function InitPin(const pin: string): Boolean; ``` Initializes the normal user's PIN. This must be called from the security officer's (SO) logged-in session. Note: To unblock a smart card, login to the SO (Security Officer) session using the PUK, and then call this with the new user PIN. Returns True for success, False for failure. ### Pkcs11.InitToken `Chilkat 11.7.0 · pascal · Pkcs11 · InitToken · method · since 9.5.0.89` ```pascal function InitToken(slotId: Integer;     const pin: string;     const tokenLabel: string): Boolean; ``` Initializes a token. `slotId` is the slot ID of the token's slot. If the token has not been initialized (i.e. new from the factory), then the pPin parameter becomes the initial value of the SO (Security Officer) PIN. If the token is being reinitialized, the `pin` parameter is checked against the existing SO PIN to authorize the initialization operation. When a token is initialized, all objects that can be destroyed are destroyed (i.e., all except for “indestructible” objects such as keys built into the token). Also, access by the normal user is disabled until the SO sets the normal user’s PIN. Depending on the token, some “default” objects may be created, and attributes of some objects may be set to default values. Returns True for success, False for failure. ### Pkcs11.Login `Chilkat 11.7.0 · pascal · Pkcs11 · Login · method · since 9.5.0.88` ```pascal function Login(userType: Integer;     const pin: string): Boolean; ``` Authenticates a session with a PIN. The `userType` can be one of the following integer values: 0> 0. Security Officer (0) 1. Normal User (1) 2. Context Specific (2) Except for special circumstances, you'll always login as the Normal User. Returns True for success, False for failure. ### Pkcs11.Logout `Chilkat 11.7.0 · pascal · Pkcs11 · Logout · method · since 9.5.0.88` ```pascal function Logout: Boolean; ``` Logs out from a token (smart card). Returns True for success, False for failure. ### Pkcs11.OpenSession `Chilkat 11.7.0 · pascal · Pkcs11 · OpenSession · method · since 9.5.0.88` ```pascal function OpenSession(slotId: Integer;     readWrite: Boolean): Boolean; ``` Opens a session on the token (i.e. smart card). The `slotId` is the ID of the slot (not the index). Set `slotId` equal to -1 to choose the first available non-empty slot. The `readWrite` indicates whether the session should be read-only or read-write. The PKCS11 terminology is confusing: - A `slot` corresponds to a connected smart card reader or USB hardware token, such as a Feitian ePass3003Auto token. - A `token` corresponds to the smart card inserted into the reader. If we have a USB hardware token, such as the epass3003Auto (or many others), then technically there is always a `smart card` inserted, because the USB hardware token is effectively both the reader and smart card wrapped in one inseparable device. - The PKCS11 DLL (or .so shared lib, or .dylib) is the vendor supplied PKCS11 implementation (driver) that provides the low-level `C` PKCS11 functions (called by Chilkat internally). - Generally, the number of slots will equal the number of connected smart cards or tokens belonging to the vendor of the DLL, or compatible with the DLL. In most cases you'll have your single reader with a single smart card inserted, and therefore only one slot exists. - Some PKCS11 DLLs are provided by a 3rd party and support many smart cards. For example, A.E.T. Europe B.V.'s `SafeSign Identity Client Standard Version 3.5` DLL is `aetpkss1.dll`. It supports the following tokens: - Defensiepas - Defensiepas 2 - G\&D Convego Join 4.01 40k/80k - G\&D SkySIM Hercules - G\&D SkySIM Scorpius - G\&D Sm@rtCafé Expert 3.2 - G\&D Sm@rtCafé Expert 4.0 - G\&D Sm@rtCafé Expert 5.0 - G\&D Sm@rtCafé Expert 6.0 - G\&D Sm@rtCafé Expert 7.0 - G\&D Sm@rtCafé Expert 64 - Gemalto Desineo ICP D72 FXR1 Java - Gemalto IDCore 30 - Gemalto MultiApp ID v2.1 - Gemalto Optelio D72 FR1 - Gemalto TOP DL v2 - Infineon Oracle JCOS Ed.1 - JCOP21 v2.3 - Morpho IDealCitiz v2.1 - Morpho JMV ProCL V3.0 - NXP J2A080 / J2A081 (JCOP 2.4.1 R3) - NXP JD081 (JCOP 2.4.1 R3) - NXP J3A080 (JCOP 2.4.1 R3) - NXP JCOP 2.4.2 R3 - NXP JCOP 3 SecID P60 - Oberthur IDOne Cosmo v7.0 - RDW ABR kaart - Rijkspas - Rijkspas 2 - Sagem YpsID s2 - Sagem YpsID s3 - StarSign Crypto USB Token S - Swissbit PS-100u SE - UZI-pas - UZI-pas 2 Returns True for success, False for failure. ### Pkcs11.QuickSession `Chilkat 11.7.0 · pascal · Pkcs11 · QuickSession · method · since 9.5.0.96` ```pascal function QuickSession(userType: Integer;     const pin: string): Boolean; ``` Quickly establishes a session on the 1st unempty slot, with or without login. If the `pin` is the empty string, then no login will take place. The `userType` can be one of the following integer values: 0> 0. Security Officer (0) 1. Normal User (1) 2. Context Specific (2) Except for special circumstances, you should always select Normal User. If `pin` is the empty string, then no login takes place and `userType` is ignored. Calling this method takes the place of making separate calls to Initialize, OpenSession, and Login. Returns True for success, False for failure. ### Pkcs11.SetPin `Chilkat 11.7.0 · pascal · Pkcs11 · SetPin · method · since 9.5.0.89` ```pascal function SetPin(const oldPin: string;     const newPin: string): Boolean; ``` Modifies the PIN of the user that is currently logged in, or the Normal User PIN if the session is not logged in. Returns True for success, False for failure. ## Related classes [`Cert`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/Cert.md), [`JsonObject`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/JsonObject.md), [`PrivateKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/PrivateKey.md), [`PublicKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/PublicKey.md), [`SshKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/SshKey.md)