ReFineID
Refined Electronic Identification.
A command-line tool, a PKCS#11 module and a desktop app for the Finnish electronic identity card. Put the card in a reader and log in to services like Suomi.fi, or sign a document, on Linux and the BSDs.
what it is
Use your ID card to log in, and to sign
Three programs from one tree. refineid on the command line reads the card, manages PINs, and produces qualified signatures (PAdES, CAdES, ASiC-E) with RFC 3161 timestamps and eIDAS trusted-list validation. librefineid_pkcs11.so exposes the card through PKCS#11 v2.40, so Firefox logs you in to services like Suomi.fi, and OpenSSL, GnuTLS and OpenSSH reach the same card through p11-kit. refineid-gui is a desktop app for PIN activation, PIN change and PUK unblock, for viewing the card's portrait and signature, and for signing PDFs. The private key never leaves the chip.
--features pin-change) until it is verified on a 2026 ECC card — the GUI's PIN change and PUK unblock are unaffected.
what signing does
Signatures that outlive the certificate
A signed document comes out at the strongest level by default — LTA for PDF and ASiC-E, LT for the other formats. It carries a qualified timestamp and the revocation evidence that was true at the moment you signed, so it still proves something years from now, after the signing certificate has expired and the services that vouched for it have moved on. Collecting that evidence is the one thing RefineID reaches the network for: a timestamp authority sees a hash and the time you asked, and your certificate's issuer answers a revocation query. None of it comes to us. Using the card — logging in, reading it, changing a PIN — contacts nothing at all.
--no-timestamp produces a baseline signature with no network contact whatsoever, which verifies only while the certificate and its revocation data are still reachable.where it runs
Platforms
| System | Path to the card | Status |
|---|---|---|
| Fedora 44 | PKCS#11 / Firefox / p11-kit | hardware-proven |
| NetBSD 10 | PKCS#11 / Firefox | hardware-proven |
| FreeBSD 14 | PKCS#11 / Firefox | untested |
| macOS | CryptoTokenKit / Safari | hardware-proven |
| Windows | minidriver / Edge / SChannel | in development |
| iOS | CoreNFC / CTK / Safari | hardware-proven |
| Android | NFC / USB / in-app browser | beta |
android
Get the Android app
Android 13 or newer, a USB CCID reader or NFC. The app's own browser opens any HTTPS service, answers certificate requests with the card, and keeps every signature behind the holder's PIN — card login and qualified PAdES signing on a stock phone. Reaching the other browsers system-wide needs the privileged platform build, so today the in-app browser is the card boundary.
sha256 168c0343b3eafba1613e16514fedc992d5cd9ce0b25eae9cf9e8bba33228dd6d
apksigner verify --print-certs. To install, open the download on the phone and allow installs from your browser when Android asks. Release builds carry no logging and no analytics; Internet access exists only in the browser boundary.source
Get the source
The Unix tree lives at github.com/refineid/refineid-unix, Apache-2.0. If you would rather not clone, the source archive keeps timestamped snapshots: each zip is the tree at the commit it names, listed with its SHA-256.
$ git clone https://github.com/refineid/refineid-unix $ cd refineid-unix # or a checksummed snapshot, no git needed -- filenames at # https://www.refineid.fi/src/ $ curl -O https://www.refineid.fi/src/RefineID-Unix-STAMP.zip $ shasum -a 256 RefineID-Unix-STAMP.zip # must match SHA256SUMS $ unzip RefineID-Unix-STAMP.zip
on your machine
Build & install
You need a PC/SC stack, the NSS tools, fontconfig, and Rust 1.95+. Packaged Rust works (pkgsrc, current distros); grab rustup only if yours is older. On NixOS you can skip all of this: one option in configuration.nix installs everything, Firefox card-login integration included — see doc/install-nixos.md.
# install the PC/SC stack, NSS tools, fontconfig, and Rust # Fedora $ sudo dnf install pcsc-lite ccid nss-tools fontconfig-devel pkgconf-pkg-config rust cargo # Debian / Ubuntu $ sudo apt install pcscd libpcsclite-dev libnss3-tools libfontconfig-dev pkg-config rustc cargo # NetBSD (as root) # pkgin install pcsc-lite ccid pcsc-tools nss fontconfig rust # start the PC/SC daemon # Linux $ sudo systemctl enable --now pcscd # NetBSD (as root) # echo pcscd=YES >> /etc/rc.conf && service pcscd start # build the CLI, the PKCS#11 module, and the GUI $ cargo build --release --workspace -> target/release/refineid -> target/release/librefineid_pkcs11.so -> target/release/refineid-gui
librefineid_pkcs11.so. Then insert the card, identify at a FINEID service (Suomi.fi / identify / certificate card) and enter PIN1. To reach the same card from OpenSSL, GnuTLS or OpenSSH instead, drop a p11-kit module file rather than registering in Firefox — the repository README has the file's shape.