Help
The DNIe in Firefox on a Mac: the PKCS#11 module
Guide updated: · by David Pelayo (nexoapex)
If Firefox behaves as though your DNIe did not exist, nothing is broken: Firefox keeps its own certificate store and, to read the card by itself, it needs a PKCS#11 module. This guide covers which one, where it lives, and why the "No es posible añadir el módulo" error ("Unable to add module" in English-language Firefox) appears.
Why Firefox needs a separate module
Safari, Chrome and Edge use the macOS keychain, and smart cards reach it through CryptoTokenKit. Apple documents that macOS recognizes USB CCID-class readers and PIV cards out of the box, but the DNIe is not a PIV card: for its certificate to appear in those browsers' dialog, a CryptoTokenKit extension has to publish it into the keychain, such as the one DNIe Pro turns on in DNIe for Mac.
Firefox takes no part in that. It keeps its own store (NSS) and talks to cards through the PKCS#11 standard, a generic interface for cryptographic devices. Without a PKCS#11 module loaded, Firefox has literally no way to see your DNIe.
There is a detail that changes everything if you use an app that publishes the DNIe into the keychain: since Firefox 75 there is a preference, security.osclientcerts.autoload, which loads an internal module called osclientcerts to read the system's client certificates on Windows and macOS. In current Firefox on macOS it is on by default (we verified it in Firefox 155 and, as of 16 September 2026, it still is in the source code of Firefox 156 and of ESR 140 and 153), and it is why an identity published into the keychain, such as the one DNIe for Mac publishes, shows up in Firefox with nothing to install. What it does not do is read the card by itself: with no app publishing it, Firefox needs the card's PKCS#11 module.
Which module to install (and which not)
The official DNIe module is published by Spain's Directorate-General of the Police in the downloads area of dnielectronico.es. As of 16 September 2026, the version is 1.6.8, offered as four files:
| Mac | Files |
|---|---|
| Intel (x64) | libpkcs11-dnie-1.6.8.dmg · libpkcs11-dnie-1.6.8.pkg |
| Apple Silicon (ARM) | libpkcs11-dnie-1.6.8_arm.dmg · libpkcs11-dnie-1.6.8_arm.pkg |
The page itself states that both cover macOS 26 Tahoe, 15 Sequoia, 14 Sonoma and 13 Ventura. It does not yet mention macOS 27, which Apple released on 14 September 2026. Choosing wrong here is the single most common mistake, and it is explained below.
One classic confusion: the FNMT publishes another module, for its own card and the DNIe, which installs at /Library/Libpkcs11-fnmtdnie/lib/libpkcs11-fnmtdnie.so. Different file, different path. If you follow a tutorial whose path does not match what you installed, Firefox will load nothing.
Installing it and loading it into Firefox
- Download the file that matches your Mac. If you are not sure which you have: Apple menu > About This Mac; if the chip name starts with "Apple", you need the
_armbuild. - Open the
.dmgand double-click the installer icon (or install the.pkg) and follow the assistant. Everything lands inside/Library/Libpkcs11-dnie. - In Firefox, go to Settings > Privacy and security, scroll down to Certificates and click Manage security devices.
- Click Load, give the module a name (the official manual suggests "DNIE Módulo P11") and enter the path:
/Library/Libpkcs11-dnie/lib/libpkcs11-dnie.so - Confirm. If all went well, the module appears in the list with one slot per connected reader.
The official manual describes the menu as "Preferencias > Avanzado > Cifrado > Dispositivos de seguridad": that is a Firefox layout from more than a decade ago — the document is written for Mac OS X Mountain Lion and Mavericks. Today's location is the one in step 3; the rest of loading the module works the same way.
Importing the root certificate
With the module loaded, Firefox can see your certificates but may still not trust who issued them. The 1.6.8 installer leaves the DNIe root certificate next to the module, though not at the path given in the official manual and in the guide from Spain's Tax Agency:
- In Settings > Privacy and security > Certificates, click Manage certificates and go to the Authorities tab.
- Click Import and point it at
/Library/Libpkcs11-dnie/AC RAIZ DNIE 2.crt(in the file picker: Macintosh HD > Library > Libpkcs11-dnie). - The assistant asks you to set the trust: tick every box it offers, as the help page that the official installer opens tells you to.
"No es posible añadir el módulo" ("Unable to add module"): the four causes
That message means one thing only: Firefox found the file but could not load it as a cryptographic module. On a Mac it is almost always one of these four.
- Wrong architecture. Since version 84, Firefox for macOS is a universal binary and runs natively as arm64 on Apple Silicon. An arm64 process cannot load a library built for Intel: if you installed the module without the
_armsuffix on an M1 or later Mac, this is exactly the error. Uninstall and install the right one. - The path does not exist. Check before arguing with Firefox. In Terminal:
ls -l /Library/Libpkcs11-dnie/lib/
Iflibpkcs11-dnie.sois not there, the install never completed and there is nothing to load.
If you follow the Tax Agency's guide, you will also see/Library/Libpkcs11-dnietif/lib/libpkcs11-dnietif.so: the official 1.6.8 package does not install that path, only/Library/Libpkcs11-dnie/lib/libpkcs11-dnie.so. - A module with that name is already loaded. Firefox will not accept two modules with the same name. If you have tried the install several times, look at the Device Manager list, unload the previous one and load it again.
- The DNIe was in the reader when you loaded it. For this error, the Tax Agency says to quit Firefox, take out the DNIe and load the module again without the card inserted. Once the module is loaded, close Firefox, insert the DNIe, open Firefox again and click "Log In" in the Device Manager. If the Mac cannot even see the reader, the problem is upstream: see the card reader guide.
To start from scratch, uninstalling is simply deleting the /Library/Libpkcs11-dnie folder, which is what the official manual says.
Checking that it worked
In the Device Manager you should see the module with one slot per reader; with the DNIe inserted, the slot shows as occupied. The real test is signing in to an e-government portal: when it asks for a certificate, Firefox should offer the DNIe's and prompt for the PIN.
One detail that saves grief: the official manual recommends setting the Certificates option to "Ask you every time" when a server requests your personal certificate, rather than letting Firefox pick one automatically. The DNIe carries two certificates — one for authentication and one for signing — and for signing in it is the authentication one you want.
If, when you sign in with the DNIe, Firefox answers "Falló el inicio de sesión" ("Failed to Login" in English-language Firefox) after you type the PIN, the Tax Agency lists four causes: an operating system that is not compatible with your version of the DNIe, a module that is not the latest version or is not properly linked from the Device Manager, a reader on its list of readers that cause problems with the DNIe 3.0, or a blocked PIN. If the Device Manager shows "Unnamed Slot", or the reader's manufacturer or model, instead of the DNIe, close Firefox, reconnect the card (in a different USB port if you can) and open Firefox again.
What you do not need
- Reader drivers. macOS has supported CCID readers natively since 10.15.
- Java. The PKCS#11 module does not use it. Java comes into play with AutoFirma, which is a different thing: see the AutoFirma on Mac guide.
- Configuration profiles or special permissions. If a tutorial asks you to disable SIP or install a profile, be suspicious.
If you would rather install nothing
All of the above is necessary because Firefox has nowhere to read the card from. With DNIe Pro, DNIe for Mac publishes your DNIe into the macOS keychain and Firefox reads it from there, just like Safari, Chrome or Edge, with no modules and no root certificates to import. How to turn it on, step by step: the guide to the DNIe in Safari, Chrome and Edge. The pricing and what is free are set out on the home page. If you are weighing this route against the official module, we compare the two in how to install the DNIe on a Mac.
And if what you want is to sign a document rather than sign in, the browser plays no part at all: see how to sign a PDF with the DNIe on a Mac.
Frequently asked questions
Why does the DNIe work in Safari but not in Firefox?
Because they reach the card by different routes. Safari, Chrome and Edge only see the DNIe if a CryptoTokenKit extension publishes it into the macOS keychain: the system recognizes the CCID reader, but has no built-in support for the DNIe, which is not a PIV card. Firefox keeps its own store: it can read the card with the official PKCS#11 module or, in current versions, use the identity another app has published into the keychain (the security.osclientcerts.autoload preference).
Why does the DNIe work in Firefox but not in Safari or Chrome?
Because the Spanish Police's official software for Mac is a PKCS#11 module, and of the common browsers Firefox is the one that lets you load that kind of module: the official instructions only explain how to do it in Firefox. Safari, Chrome and Edge look for certificates in the macOS keychain, and the DNIe only appears there if an app publishes it through CryptoTokenKit, as DNIe for Mac does with DNIe Pro. In that case it also appears in Firefox, which in current versions reads the system's client certificates out of the box. We explain it step by step in the guide to the DNIe in Safari, Chrome and Edge.
Which path do I enter when loading the module?
/Library/Libpkcs11-dnie/lib/libpkcs11-dnie.so, which is where the official installer puts the library on macOS. Careful: the FNMT publishes a different module that lives at /Library/Libpkcs11-fnmtdnie/lib/libpkcs11-fnmtdnie.so; pointing at the wrong one produces the same error.
I get "No es posible añadir el módulo" ("Unable to add module"). What does that mean?
That Firefox found the path but could not load the library. There are four usual causes: installing the module for the wrong architecture (Intel on an Apple Silicon Mac or the other way round), a path that does not exist because the install never completed, a module already loaded under that same name, or trying to load it with the DNIe inserted (Spain's Tax Agency says to load it again without the card).
Do I need a driver for the card reader?
No. Since macOS 10.15, any USB CCID-class reader works out of the box through CryptoTokenKit, with no extra software. The PKCS#11 module is not a reader driver: it is the piece that teaches Firefox how to talk to the card.
Does DNIe for Mac cover Firefox?
Yes. DNIe for Mac publishes your DNIe into the macOS keychain, and current Firefox reads the system's client certificates out of the box, so the certificate appears in its dialog with no module to install. Publishing that identity is the DNIe Pro feature. If you don't use the app, the route for Firefox is the official module this guide describes.