$ lsusb | grep token
Bus 003 Device 004: ID 0a89:0030 Aktiv Rutoken ECP
Bus 003 Device 005: ID 0a89:0030 Aktiv Rutoken ECP

[Thu Apr 21 15:02:36 MSK 2022 regl1 21795] choosen object or function: Импорт сертификата
[Thu Apr 21 15:02:36 MSK 2022 regl1 21795] import cert for token: Aktiv Rutoken ECP 00 00 with key_id: 
[Thu Apr 21 15:02:36 MSK 2022 regl1 21795] gen new cert id for token: Aktiv Rutoken ECP 00 00
[Thu Apr 21 15:02:36 MSK 2022 regl1 21795] get_key_list from token: Aktiv Rutoken ECP 00 00
[Thu Apr 21 15:02:36 MSK 2022 regl1 21795] Key list:
41
[Thu Apr 21 15:02:36 MSK 2022 regl1 21795] key_id not specifed. Generated is 647a30536a645a71
[Thu Apr 21 15:02:45 MSK 2022 regl1 21795] convert cert from PEM to DER format
[Thu Apr 21 15:02:45 MSK 2022 regl1 21795] cert path changed to cert.crt
[Thu Apr 21 15:02:57 MSK 2022 regl1 21795] choosen cert label is: regl1
[Thu Apr 21 15:02:57 MSK 2022 regl1 21795] import object located by cert.crt with type: cert, id: 647a30536a645a71, label:regl1 on token: Aktiv Rutoken ECP 00 00 
[Thu Apr 21 15:02:57 MSK 2022 regl1 21795] error Can't import object on token:
error: PKCS11 function C_CreateObject failed: rv = CKR_FUNCTION_FAILED (0x6)
Aborting.
[Thu Apr 21 15:02:57 MSK 2022 regl1 21795] error Не удалось импортировать сертификат на токен
[Thu Apr 21 15:03:13 MSK 2022 regl1 21795] show_token_obj for token Aktiv Rutoken ECP 00 00
[Thu Apr 21 15:03:13 MSK 2022 regl1 21795] get_token_objects from token Aktiv Rutoken ECP 00 00 of type:  with atr:  value: 
[Thu Apr 21 15:03:14 MSK 2022 regl1 21795] Object list:
Public Key Object; RSA 2048 bits
  label:      KeyPairRSA-regl1
  ID:         41
  Usage:      encrypt, verify, wrap
  Access:     local
Private Key Object; RSA 
  label:      KeyPairRSA-regl1
  ID:         41
  Usage:      decrypt, sign, unwrap
  Access:     sensitive, always sensitive, never extractable, local
[Thu Apr 21 15:03:14 MSK 2022 regl1 21795] formated objects:
Тип     Идентификатор   Метка   Свойства        Назначение
Открытый ключ   41      KeyPairRSA-regl1        RSA 2048 bits   encrypt, verify, wrap
Закрытый ключ   41      KeyPairRSA-regl1        RSA     decrypt, sign, unwrap
[Thu Apr 21 15:03:14 MSK 2022 regl1 21795] Objects:
Тип     Идентификатор   Метка   Свойства        Назначение
Открытый ключ   41      KeyPairRSA-regl1        RSA 2048 bits   encrypt, verify, wrap
Закрытый ключ   41      KeyPairRSA-regl1        RSA     decrypt, sign, unwrap

$ pkcs15-init --erase-card --reader 0
$ pkcs15-init --reader 0 --create-pkcs15 --so-pin "87654321" --so-puk ""
$ pkcs15-init --reader 0 --store-pin --label "User PIN" --auth-id 02 --pin "12345678" --puk "" --so-pin "87654321" --finalize

$ pkcs15-tool -v -D --reader 0
Connecting to card in reader Aktiv Rutoken ECP 00 00...
Using card driver Rutoken ECP and Lite driver.
Trying to find a PKCS#15 compatible card...
Found Rutoken ECP!
PKCS#15 Card [Rutoken ECP]:
    Version        : 0
    Serial number  : 0000000029875944
    Manufacturer ID: Aktiv Co.
    Last update    : 20220420214735Z
    Flags          : EID compliant


Card has 2 Authentication object(s).

PIN [Security Officer PIN]
    Object Flags   : [0x03], private, modifiable
    ID             : 01
    Flags          : [0x99], case-sensitive, unblock-disabled, initialized, soPin
    Length         : min_len:8, max_len:32, stored_len:32
    Pad char       : 0x00
    Reference      : 1 (0x01)
    Type           : ascii-numeric

PIN [User PIN]
    Object Flags   : [0x03], private, modifiable
    ID             : 02
    Flags          : [0x19], case-sensitive, unblock-disabled, initialized
    Length         : min_len:4, max_len:32, stored_len:32
    Pad char       : 0x00
    Reference      : 2 (0x02)
    Type           : ascii-numeric

Card has 0 Private key(s).

Card has 0 Public key(s).

Card has 0 Secret key(s).

Card has 0 Certificate(s).

Card has 0 Data object(s).

$ pkcs11-tool --module /usr/lib64/librtpkcs11ecp.so --keypairgen --key-type "rsa:2048" -l -p "12345678" --id 41 --label "KeyPairRSA-regl1" --slot-description "Aktiv Rutoken ECP 00 00"
Key pair generated:
Private Key Object; RSA 
  label:      KeyPairRSA-regl1
  ID:         41
  Usage:      decrypt, sign, unwrap
  Access:     sensitive, always sensitive, never extractable, local
Public Key Object; RSA 2048 bits
  label:      KeyPairRSA-regl1
  ID:         41
  Usage:      encrypt, verify, wrap
  Access:     local
$ openssl
OpenSSL> engine dynamic -pre SO_PATH:/usr/lib64/engines-1.1/pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1  -pre LOAD -pre MODULE_PATH:/usr/lib64/librtpkcs11ecp.so
(dynamic) Dynamic engine loading support
[Success]: SO_PATH:/usr/lib64/engines-1.1/pkcs11.so
[Success]: ID:pkcs11
[Success]: LIST_ADD:1
[Success]: LOAD
[Success]: MODULE_PATH:/usr/lib64/librtpkcs11ecp.so
Loaded: (pkcs11) pkcs11 engine
OpenSSL> req -engine pkcs11 -new -key 0:41 -keyform engine -out cert-req-regl1-2022.pem -text -subj "/C=RU/ST=Moscow/L=Moscow/O=Inbank Ltd/OU=IT/CN=regl1"
engine "pkcs11" set.
Enter PKCS#11 token PIN for Rutoken ECP <no label>:
OpenSSL> exit
$ ls -l cert-req-regl1-2022.pem
-rw-rw-r--. 1 regl1 regl1 3482 Apr 21 01:00 cert-req-regl1-2022.pem

$ ls -l regl1-2022.cer 
-rw-r--r--. 1 regl1 regl1 1756 Apr 21 01:06 regl1-2022.cer
$ pkcs11-tool --module /usr/lib64/librtpkcs11ecp.so -l -y cert -w regl1-2022.cer --id 41 --slot-description "Aktiv Rutoken ECP 00 00"
Logging in to "Rutoken ECP <no label>".
Please enter User PIN: 
error: PKCS11 function C_CreateObject failed: rv = CKR_FUNCTION_FAILED (0x6)
Aborting.
$ pkcs11-tool --module /usr/lib64/librtpkcs11ecp.so -l -O --slot-description "Aktiv Rutoken ECP 00 00"
Logging in to "Rutoken ECP <no label>".
Please enter User PIN: 
Public Key Object; RSA 2048 bits
  label:      KeyPairRSA-regl1
  ID:         41
  Usage:      encrypt, verify, wrap
  Access:     local
Private Key Object; RSA 
  label:      KeyPairRSA-regl1
  ID:         41
  Usage:      decrypt, sign, unwrap
  Access:     sensitive, always sensitive, never extractable, local
$