--- a/browser/components/extensions/ext-browser.json
+++ b/browser/components/extensions/ext-browser.json
@@ -117,16 +117,24 @@
     "url": "chrome://browser/content/ext-pageAction.js",
     "schema": "chrome://browser/content/schemas/page_action.json",
     "scopes": ["addon_parent"],
     "manifest": ["page_action"],
     "paths": [
       ["pageAction"]
     ]
   },
+  "pkcs11": {
+    "url": "chrome://browser/content/ext-pkcs11.js",
+    "schema": "chrome://browser/content/schemas/pkcs11.json",
+    "scopes": ["addon_parent"],
+    "paths": [
+      ["pkcs11"]
+    ]
+  },
   "geckoProfiler": {
     "url": "chrome://browser/content/ext-geckoProfiler.js",
     "schema": "chrome://browser/content/schemas/geckoProfiler.json",
     "scopes": ["addon_parent"],
     "paths": [
       ["geckoProfiler"]
     ]
   },

new file mode 100644
--- /dev/null
+++ b/browser/components/extensions/ext-pkcs11.js
@@ -0,0 +1,145 @@
+"use strict";
+
+XPCOMUtils.defineLazyModuleGetters(this, {
+  ctypes: "resource://gre/modules/ctypes.jsm",
+  NativeManifests: "resource://gre/modules/NativeManifests.jsm",
+  OS: "resource://gre/modules/osfile.jsm",
+});
+
+XPCOMUtils.defineLazyServiceGetter(this,
+  "pkcs11db",
+  "@mozilla.org/security/pkcs11moduledb;1",
+  "nsIPKCS11ModuleDB");
+
+var {DefaultMap} = ExtensionUtils;
+
+const findModuleByPath = function(path) {
+  let modules = pkcs11db.listModules();
+  for (let module of XPCOMUtils.IterSimpleEnumerator(modules, Ci.nsIPKCS11Module)) {
+    if (module && module.libName === path) {
+      return module;
+    }
+  }
+  return null;
+};
+
+this.pkcs11 = class extends ExtensionAPI {
+  getAPI(context) {
+    let manifestCache = new DefaultMap(async name => {
+      let hostInfo = await NativeManifests.lookupManifest("pkcs11", name, context);
+      if (hostInfo) {
+        if (AppConstants.platform === "win") {
+          hostInfo.manifest.path = OS.Path.join(OS.Path.dirname(hostInfo.path), hostInfo.manifest.path);
+        }
+        let manifestLib = OS.Path.basename(hostInfo.manifest.path);
+        if (AppConstants.platform !== "linux") {
+          manifestLib = manifestLib.toLowerCase(manifestLib);
+        }
+        if (manifestLib !== ctypes.libraryName("nssckbi")) {
+          return hostInfo.manifest;
+        }
+      }
+      return Promise.reject({message: `No such PKCS#11 module ${name}`});
+    });
+    return {
+      pkcs11: {
+        /**
+          * Verify whether a given PKCS#11 module is installed.
+          *
+          * @param {string} name The name of the module, as specified in
+          *                      the manifest file.
+          * @returns {Promise} A Promise that resolves to true if the package
+          *                    is installed, or false if it is not. May be
+          *                    rejected if the module could not be found.
+          */
+        async isModuleInstalled(name) {
+          let manifest = await manifestCache.get(name);
+          return findModuleByPath(manifest.path) !== null;
+        },
+        /**
+          * Install a PKCS#11 module
+          *
+          * @param {string} name The name of the module, as specified in
+          *                      the manifest file.
+          * @param {integer} [flags = 0] Any flags to be passed on to the
+          *                              nsIPKCS11ModuleDB.addModule method
+          * @returns {Promise} When the Promise resolves, the module will have
+          *                    been installed. When it is rejected, the module
+          *                    either is already installed or could not be
+          *                    installed for some reason.
+          */
+        async installModule(name, flags = 0) {
+          let manifest = await manifestCache.get(name);
+          if (!manifest.description) {
+            return Promise.reject({message: `The description field in the manifest for PKCS#11 module ${name} must have a value`});
+          }
+          pkcs11db.addModule(manifest.description, manifest.path, flags, 0);
+        },
+        /**
+          * Uninstall a PKCS#11 module
+          *
+          * @param {string} name The name of the module, as specified in
+          *                      the manifest file.
+          * @returns {Promise}. When the Promise resolves, the module will have
+          *                     been uninstalled. When it is rejected, the
+          *                     module either was not installed or could not be
+          *                     uninstalled for some reason.
+          */
+        async uninstallModule(name) {
+          let manifest = await manifestCache.get(name);
+          let module = findModuleByPath(manifest.path);
+          if (!module) {
+            return Promise.reject({message: `The PKCS#11 module ${name} is not loaded`});
+          }
+          pkcs11db.deleteModule(module.name);
+        },
+        /**
+         * Get a list of slots for a given PKCS#11 module, with
+         * information on the token (if any) in the slot.
+         *
+         * The PKCS#11 standard defines slots as an abstract concept
+         * that may or may not have at most one token. In practice, when
+         * using PKCS#11 for smartcards (the most likely use case of
+         * PKCS#11 for Firefox), a slot corresponds to a cardreader, and
+         * a token corresponds to a card.
+         *
+         * @param {string} name The name of the PKCS#11 module, as
+         *                 specified in the manifest file.
+         * @returns {Promise} A promise that resolves to an array of objects
+         *                    with two properties.  The `name` object contains
+         *                    the name of the slot; the `token` object is null
+         *                    if there is no token in the slot, or is an object
+         *                    describing various properties of the token if
+         *                    there is.
+         */
+        async getModuleSlots(name) {
+          let manifest = await manifestCache.get(name);
+          let module = findModuleByPath(manifest.path);
+          if (!module) {
+            return Promise.reject({message: `The module ${name} is not installed`});
+          }
+          let rv = [];
+          for (let slot of XPCOMUtils.IterSimpleEnumerator(module.listSlots(), Ci.nsIPKCS11Slot)) {
+            let token = slot.getToken();
+            let slotobj = {
+              name: slot.name,
+              token: null,
+            };
+            if (slot.status != 1 /* SLOT_NOT_PRESENT */) {
+              slotobj.token = {
+                name: token.tokenName,
+                manufacturer: token.tokenManID,
+                HWVersion: token.tokenHWVersion,
+                FWVersion: token.tokenFWVersion,
+                serial: token.tokenSerialNumber,
+                isLoggedIn: token.isLoggedIn(),
+              };
+            }
+            rv.push(slotobj);
+          }
+          return rv;
+        },
+      },
+    };
+  }
+};

--- a/browser/components/extensions/jar.mn
+++ b/browser/components/extensions/jar.mn
@@ -24,16 +24,17 @@ browser.jar:
     content/browser/ext-devtools-network.js
     content/browser/ext-devtools-panels.js
     content/browser/ext-find.js
     content/browser/ext-geckoProfiler.js
     content/browser/ext-history.js
     content/browser/ext-menus.js
     content/browser/ext-omnibox.js
     content/browser/ext-pageAction.js
+    content/browser/ext-pkcs11.js
     content/browser/ext-sessions.js
     content/browser/ext-sidebarAction.js
     content/browser/ext-tabs.js
     content/browser/ext-url-overrides.js
     content/browser/ext-windows.js
     content/browser/ext-c-browser.js
     content/browser/ext-c-devtools-inspectedWindow.js
     content/browser/ext-c-devtools-panels.js

--- a/browser/components/extensions/schemas/jar.mn
+++ b/browser/components/extensions/schemas/jar.mn
@@ -14,13 +14,14 @@ browser.jar:
     content/browser/schemas/devtools_panels.json
     content/browser/schemas/find.json
     content/browser/schemas/geckoProfiler.json
     content/browser/schemas/history.json
     content/browser/schemas/menus.json
     content/browser/schemas/menus_internal.json
     content/browser/schemas/omnibox.json
     content/browser/schemas/page_action.json
+    content/browser/schemas/pkcs11.json
     content/browser/schemas/sessions.json
     content/browser/schemas/sidebar_action.json
     content/browser/schemas/tabs.json
     content/browser/schemas/url_overrides.json
     content/browser/schemas/windows.json

new file mode 100644
--- /dev/null
+++ b/browser/components/extensions/schemas/pkcs11.json
@@ -0,0 +1,76 @@
+[
+  {
+    "namespace": "manifest",
+    "types": [
+      {
+        "$extend": "Permission",
+        "choices": [{
+          "type": "string",
+          "enum": [
+            "pkcs11"
+          ]
+        }]
+      }
+    ]
+  },
+  {
+    "namespace": "pkcs11",
+    "description": "PKCS#11 module management API",
+    "permissions": ["pkcs11"],
+    "functions": [
+      {
+        "name": "isModuleInstalled",
+        "type": "function",
+        "description": "checks whether a PKCS#11 module, given by name, is installed",
+        "async": true,
+        "parameters": [
+          {
+            "name": "name",
+            "type": "string"
+          }
+        ]
+      },
+      {
+        "name": "installModule",
+        "type": "function",
+        "description": "Install a PKCS#11 module with a given name",
+        "async": true,
+        "parameters": [
+          {
+            "name": "name",
+            "type": "string"
+          },
+          {
+            "name": "flags",
+            "type": "integer",
+            "optional": true
+          }
+        ]
+      },
+      {
+        "name": "uninstallModule",
+        "type": "function",
+        "description": "Remove an installed PKCS#11 module from firefox",
+        "async": true,
+        "parameters": [
+          {
+            "name": "name",
+            "type": "string"
+          }
+        ]
+      },
+      {
+        "name": "getModuleSlots",
+        "type": "function",
+        "description": "Enumerate a module's slots, each with their name and whether a token is present",
+        "async": true,
+        "parameters": [
+          {
+            "name": "name",
+            "type": "string"
+          }
+        ]
+      }
+    ]
+  }
+]

new file mode 100644
--- /dev/null
+++ b/browser/components/extensions/test/xpcshell/test_ext_pkcs11_management.js
@@ -0,0 +1,168 @@
+"use strict";
+
+XPCOMUtils.defineLazyModuleGetters(this, {
+  ctypes: "resource://gre/modules/ctypes.jsm",
+  MockRegistry: "resource://testing-common/MockRegistry.jsm",
+  OS: "resource://gre/modules/osfile.jsm",
+});
+
+do_get_profile();
+let tmpDir = FileUtils.getDir("TmpD", ["PKCS11"]);
+let slug = AppConstants.platform === "linux" ? "pkcs11-modules" : "PKCS11Modules";
+tmpDir.createUnique(Ci.nsIFile.DIRECTORY_TYPE, FileUtils.PERMS_DIRECTORY);
+let baseDir = OS.Path.join(tmpDir.path, slug);
+OS.File.makeDir(baseDir);
+
+do_register_cleanup(() => {
+  tmpDir.remove(true);
+});
+
+function getPath(filename) {
+  return OS.Path.join(baseDir, filename);
+}
+
+const testmodule = "../../../../../security/manager/ssl/tests/unit/pkcs11testmodule/" + ctypes.libraryName("pkcs11testmodule");
+
+// This function was inspired by the native messaging test under
+// toolkit/components/extensions
+
+async function setupManifests(modules) {
+  async function writeManifest(module) {
+    let manifest = {
+      name: module.name,
+      description: module.description,
+      path: module.path,
+      type: "pkcs11",
+      allowed_extensions: [module.id],
+    };
+
+    let manifestPath = getPath(`${module.name}.json`);
+    await OS.File.writeAtomic(manifestPath, JSON.stringify(manifest));
+
+    return manifestPath;
+  }
+
+  switch (AppConstants.platform) {
+    case "macosx":
+    case "linux":
+      let dirProvider = {
+        getFile(property) {
+          if (property == "XREUserNativeManifests") {
+            return tmpDir.clone();
+          } else if (property == "XRESysNativeManifests") {
+            return tmpDir.clone();
+          }
+          return null;
+        },
+      };
+
+      Services.dirsvc.registerProvider(dirProvider);
+      do_register_cleanup(() => {
+        Services.dirsvc.unregisterProvider(dirProvider);
+      });
+
+      for (let module of modules) {
+        await writeManifest(module);
+      }
+      break;
+
+    case "win":
+      const REGKEY = String.raw`Software\Mozilla\PKCS11Modules`;
+
+      let registry = new MockRegistry();
+      do_register_cleanup(() => {
+        registry.shutdown();
+      });
+
+      for (let module of modules) {
+        if (!OS.Path.winIsAbsolute(module.path)) {
+          let cwd = await OS.File.getCurrentDirectory();
+          module.path = OS.Path.join(cwd, module.path);
+        }
+        let manifestPath = await writeManifest(module);
+        registry.setValue(Ci.nsIWindowsRegKey.ROOT_KEY_CURRENT_USER,
+                          `${REGKEY}\\${module.name}`, "", manifestPath);
+      }
+      break;
+
+    default:
+      ok(false, `Loading of PKCS#11 modules is not supported on ${AppConstants.platform}`);
+  }
+}
+
+add_task(async function test_pkcs11() {
+  async function background() {
+    try {
+      let isInstalled = await browser.pkcs11.isModuleInstalled("testmodule");
+      browser.test.assertFalse(isInstalled, "PKCS#11 module is not installed before we install it");
+      await browser.pkcs11.installModule("testmodule", 0);
+      isInstalled = browser.pkcs11.isModuleInstalled("testmodule");
+      browser.test.assertTrue(isInstalled, "PKCS#11 module is installed after we install it");
+      let slots = await browser.pkcs11.getModuleSlots("testmodule");
+      browser.test.assertEq("Test PKCS11 Slot", slots[0].name, "The first slot name matches the expected name");
+      browser.test.assertEq("Test PKCS11 Slot 二", slots[1].name, "The second slot name matches the expected name");
+      browser.test.assertTrue(slots[1].token, "The second slot has a token");
+      browser.test.assertEq("Test PKCS11 Tokeñ 2 Label", slots[1].token.name, "The token name matches the expected name");
+      browser.test.assertEq("Test PKCS11 Manufacturer ID", slots[1].token.manufacturer, "The token manufacturer matches the expected manufacturer");
+      browser.test.assertEq("0.0", slots[1].token.HWVersion, "The token hardware version matches the expected version");
+      browser.test.assertEq("0.0", slots[1].token.FWVersion, "The token firmware version matches the expected version");
+      browser.test.assertEq("", slots[1].token.serial, "The token has no serial number");
+      browser.test.assertFalse(slots[1].token.isLoggedIn, "The token is not logged in");
+      await browser.pkcs11.uninstallModule("testmodule");
+      isInstalled = await browser.pkcs11.isModuleInstalled("testmodule");
+      browser.test.assertFalse(isInstalled, "PKCS#11 module is no longer installed after we uninstall it");
+      await browser.pkcs11.installModule("testmodule");
+      isInstalled = await browser.pkcs11.isModuleInstalled("testmodule");
+      browser.test.assertTrue(isInstalled, "Installing the PKCS#11 module without flags parameter succeeds");
+      await browser.pkcs11.uninstallModule("testmodule");
+      await browser.test.assertRejects(
+        browser.pkcs11.isModuleInstalled("nonexistingmodule"),
+        /No such PKCS#11 module nonexistingmodule/,
+        "We cannot access modules if no JSON file exists");
+      await browser.test.assertRejects(
+        browser.pkcs11.isModuleInstalled("othermodule"),
+        /No such PKCS#11 module othermodule/,
+        "We cannot access modules if we're not listed in the module's manifest file's allowed_extensions key");
+      await browser.test.assertRejects(
+        browser.pkcs11.uninstallModule("internalmodule"),
+        /No such PKCS#11 module internalmodule/,
+        "We cannot uninstall the NSS Builtin Roots Module");
+      browser.test.notifyPass("pkcs11");
+    } catch (e) {
+      browser.test.fail(`Error: ${String(e)} :: ${e.stack}`);
+      browser.test.notifyFail("pkcs11 failed");
+    }
+  }
+
+  await setupManifests([
+    {
+      name: "testmodule",
+      description: "PKCS#11 Test Module",
+      path: testmodule,
+      id: "pkcs11@tests.mozilla.org",
+    },
+    {
+      name: "othermodule",
+      description: "PKCS#11 Test Module",
+      path: testmodule,
+      id: "other@tests.mozilla.org",
+    },
+    {
+      name: "internalmodule",
+      description: "Builtin Roots Module",
+      path: ctypes.libraryName("nssckbi"),
+      id: "pkcs11@tests.mozilla.org",
+    },
+  ]);
+
+  let extension = ExtensionTestUtils.loadExtension({
+    manifest: {
+      permissions: ["pkcs11"],
+      applications: {"gecko": {id: "pkcs11@tests.mozilla.org"}},
+    },
+    background: background,
+  });
+  await extension.startup();
+  await extension.awaitFinish("pkcs11");
+  await extension.unload();
+});

--- a/browser/components/extensions/test/xpcshell/xpcshell.ini
+++ b/browser/components/extensions/test/xpcshell/xpcshell.ini
@@ -15,10 +15,11 @@ dupe-manifest =
 #    For tests which should run in all configurations.
 #  - xpcshell-remote.ini
 #    For tests which should only run with both remote extensions and remote content.
 
 [test_ext_manifest_commands.js]
 [test_ext_manifest_omnibox.js]
 [test_ext_manifest_permissions.js]
 [test_ext_geckoProfiler_schema.js]
+[test_ext_pkcs11_management.js]
 
 [include:xpcshell-common.ini]

--- a/browser/locales/en-US/chrome/browser/browser.properties
+++ b/browser/locales/en-US/chrome/browser/browser.properties
@@ -106,16 +106,17 @@ webextPerms.description.downloads.open=O
 webextPerms.description.find=Read the text of all open tabs
 webextPerms.description.geolocation=Access your location
 webextPerms.description.history=Access browsing history
 webextPerms.description.management=Monitor extension usage and manage themes
 # LOCALIZATION NOTE (webextPerms.description.nativeMessaging)
 # %S will be replaced with the name of the application
 webextPerms.description.nativeMessaging=Exchange messages with programs other than %S
 webextPerms.description.notifications=Display notifications to you
+webextPerms.description.pkcs11=Provide cryptographic authentication services
 webextPerms.description.privacy=Read and modify privacy settings
 webextPerms.description.proxy=Control browser proxy settings
 webextPerms.description.sessions=Access recently closed tabs
 webextPerms.description.tabs=Access browser tabs
 webextPerms.description.topSites=Access browsing history
 webextPerms.description.unlimitedStorage=Store unlimited amount of client-side data
 webextPerms.description.webNavigation=Access browser activity during navigation