...
*Back to [[Book|Administrator's Configuration File Reference#cfr]] [[Topic|Administrator's Configuration File Reference#chap3]]*
h2. {{server.xml}} elements beginning with P
The following elements are discussed below:
|[#{{pkcs11}}] |[#{{pkcs11 bypass}}] |[#{{profiler}}] |
|[#{{property}}] |[#{{property-db}}] |
h3. {{pkcs11}} {anchor:p1}
The {{pkcs11}} element configures the PKCS #11 subsystem. This element may appear zero or one time within the {{server}} element. For more information, see [{{server}}|S#s3].
h4. Subelements
The {{pkcs11}} element can contain the following subelements:
Table 3-35 List of {{pkcs11}} Subelements
||Element ||Occurrences ||Description ||
|{{enabled}} |0 or 1 |Determines whether the server initializes PKCS#11 tokens, prompting for Personal Identification Numbers (PINs) as necessary. The default value is {{true}} if SSL is enabled and {{false}} if SSL is not enabled. |
|{{crl-path}} |0 or 1 |The directory that contains dynamically updated CRL files. The value is the name of the directory. If a relative path is used, it is relative to the server's {{config}} directory. |
|{{token}} |0 or more |Configures a PKCS#11 token. For more details, see [{{token}}|T#t3]. |
h4. See Also
* [{{ssl}}|S#s9]
* [{{http-listener}}|F & H#h2]
h3. {{pkcs11 bypass}}
The {{pkcs11 bypass}} element instructs the NSS to bypass the PKCS#11 layer during SSL/TLS processing, thereby improving performance.
During startup, the server automatically verifies each token, holding a server key, to assess if they support PKCS#11 bypass. If the tokens support bypass in the current configuration the PKCS#11 layer will be bypassed, else the bypass will be disabled. Thus, the server automatically takes advantage of the performance benefits of pkcs11 bypass whenever possible.
In certain unique circumstances, you can disable PKCS#11 bypass manually by using the {{server.xml}} element {{<allow-bypass>}}.
{code}
<pkcs11>
<enabled>1</enabled>
<allow-bypass>0</allow-bypass>
</pkcs11>
{code}