Help

The DNIe in Firefox on a Mac: the PKCS#11 module

Guide updated: 21 August 2026 · by David Pelayo (nexoapex)

If your DNIe works in Safari but Firefox behaves as though it did not exist, nothing is broken: Firefox does not use the macOS certificate store. It keeps its own, and to make it see the card you have to load a PKCS#11 module. This guide covers which one, where it lives, and why the "unable to add module" error appears.

Why Firefox needs a separate module

Safari, Chrome and Edge reach the DNIe's certificates through CryptoTokenKit, macOS's smart-card subsystem. Apple documents that the system natively recognises any USB CCID-class reader with no extra software: that is why, in those browsers, the certificate simply appears in the browser's own dialog.

Firefox takes no part in that. It keeps its own store (NSS) and talks to cards through the PKCS#11 standard, a generic interface for cryptographic devices. Without a PKCS#11 module loaded, Firefox has literally no way to see your DNIe.

There is a partial exception worth knowing about: since Firefox 75 there is a preference, security.osclientcerts.autoload, which loads an internal module called osclientcerts to read the system's client certificates on Windows and macOS. It is aimed mainly at certificates imported into the keychain, and Mozilla has open reports that on macOS it does not always present them correctly. For the DNIe, the reliable route is still the card's PKCS#11 module.

Which module to install (and which not)

The official DNIe module is published by Spain's Directorate-General of the Police in the downloads area of dnielectronico.es. As of today the version is 1.6.8, offered as four files:

The page itself states that both cover macOS 26 Tahoe, 15 Sequoia, 14 Sonoma and 13 Ventura. Choosing wrong here is the single most common mistake, and it is explained below.

One classic confusion: the FNMT publishes another module, for its own card and the DNIe, which installs at /Library/Libpkcs11-fnmtdnie/lib/libpkcs11-fnmtdnie.so. Different file, different path. If you follow a tutorial whose path does not match what you installed, Firefox will load nothing.

Installing it and loading it into Firefox

1. Download the file that matches your Mac. If you are not sure which you have: Apple menu > About This Mac; if the chip name starts with "Apple", you need the _arm build.
2. Open the .dmg and double-click the installer icon (or install the .pkg) and follow the assistant. Everything lands inside /Library/Libpkcs11-dnie.
3. In Firefox, go to Settings > Privacy & Security, scroll down to Certificates and click Security Devices.
4. Click Load, give the module a name —the official manual suggests "DNIe Módulo P11"— and enter the path:
   /Library/Libpkcs11-dnie/lib/libpkcs11-dnie.so
5. Confirm. If all went well, the module appears in the list with one slot per connected reader.

The official manual describes the menu as "Preferencias > Avanzado > Cifrado > Dispositivos de seguridad": that is a Firefox layout from more than a decade ago — the document is written for Mac OS X Mountain Lion and Mavericks. Today's location is the one in step 3; the rest of the procedure is unchanged.

Importing the root certificate

With the module loaded, Firefox can see your certificates but may still not trust who issued them. The installer leaves the DNIe root certificate next to the module:

1. In Settings > Privacy & Security > Certificates, click View Certificates and go to the Authorities tab.
2. Click Import and point it at /Library/Libpkcs11-dnie/share/ac_raiz_dnie.crt.
3. The assistant asks you to set the trust: tick all three boxes, as the official manual instructs.

"Unable to add module": the four causes

That message means one thing only: Firefox found the file but could not load it as a cryptographic module. On a Mac it is almost always one of these four.

• Wrong architecture. Since version 84, Firefox for macOS is a universal binary and runs natively as arm64 on Apple Silicon. An arm64 process cannot load a library built for Intel: if you installed the module without the _arm suffix on an M1 or later Mac, this is exactly the error. Uninstall and install the right one.
• The path does not exist. Check before arguing with Firefox. In Terminal:
  ls -l /Library/Libpkcs11-dnie/lib/
  If libpkcs11-dnie.so is not there, the install never completed and there is nothing to load.
• A module with that name is already loaded. Firefox will not accept two modules with the same name. If you have tried the install several times, look at the Security Devices list, unload the previous one and load it again.
• The reader is not connected. Some modules fail to initialise when they find no reader. Plug the reader in —with the DNIe inserted— and try again. If the Mac cannot even see the reader, the problem is upstream: see the card reader guide.

To start from scratch, uninstalling is simply deleting the /Library/Libpkcs11-dnie folder, which is what the official manual says.

Checking that it worked

Under Security Devices you should see the module with one slot per reader; with the DNIe inserted, the slot shows as occupied. The real test is signing in to an e-government portal: when it asks for a certificate, Firefox should offer the DNIe's and prompt for the PIN.

One detail that saves grief: the official manual recommends setting the Certificates option to "Ask you every time" when a server requests your personal certificate, rather than letting Firefox pick one automatically. The DNIe carries two certificates —one for authentication and one for signing— and for signing in it is the authentication one you want.

What you do not need

• Reader drivers. macOS has supported CCID readers natively since 10.15.
• Java. The PKCS#11 module does not use it. Java comes into play with AutoFirma, which is a different thing: see the AutoFirma on Mac guide.
• Configuration profiles or special permissions. If a tutorial asks you to disable SIP or install a profile, be suspicious.

If you would rather install nothing

All of the above is necessary because you use Firefox. In Safari, Chrome and Edge the DNIe works through macOS's native integration, with no modules and no root certificates to import. That is the route DNIe Pro covers in the Mac App Store build; the pricing and what is free are set out on the home page. Its own PKCS#11 module for Firefox is planned for the direct-download edition, which is not out yet.

And if what you want is to sign a document rather than sign in, the browser plays no part at all: see how to sign a PDF with the DNIe on a Mac.

Frequently asked questions