Python library for signing x509 using keys in an pkcs11 device such as a HSM
Project description
python_x509_pkcs11
Seamless signing x509 using PKCS11 device for key storage
Currently supports
- Creating a root CA and generating its RSA key in the PKCS11 device
- Using the key in the PKCS11 device to sign certificates (or Intermediate CAs)
- Creating CRLs with the PKCS11 device key
- Store multiple keys in the PKCS11 device enabling a full PKI infrastructure
- 'Advanced' handling of fragile persistent PKCS11 sessions, including recreating the session if PKCS11 operation timeout
This package is pretty much a wrapper around python-pkcs11 and asn1crypto
Setup
# Install this package
pip install python_x509_pkcs11
# Install deps and add your user to the softhsm group
sudo apt-get install opensc softhsm2
sudo usermod -a -G softhsm $USER
sudo reboot # Yeah seem to not update your groups without a reboot
# export env values the code will use
export PKCS11_MODULE="/usr/lib/softhsm/libsofthsm2.so"
export PKCS11_PIN="1234"
export PKCS11_TOKEN="my_test_token_1"
# Initialize the token
softhsm2-util --init-token --slot 0 --label $PKCS11_TOKEN --pin $PKCS11_PIN --so-pin $PKCS11_PIN
Usage
Look at the tests/test_root_ca.py
Tests
# Install the package
pip install python_x509_pkcs11
# Export env vars
export PKCS11_MODULE="/usr/lib/softhsm/libsofthsm2.so"
export PKCS11_TOKEN='my_test_token_1'
export PKCS11_PIN='1234'
# Delete and init a token
softhsm2-util --delete-token --token my_test_token_1
softhsm2-util --init-token --slot 0 --label $PKCS11_TOKEN --pin $PKCS11_PIN --so-pin $PKCS11_PIN
# Run unittest with mypy and pylint
mypy --strict --namespace-packages --ignore-missing-imports tests/*.py
pylint tests/*.py
python3 -m unittest tests/*.py
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
File details
Details for the file python_x509_pkcs11-0.1.6.tar.gz.
File metadata
- Download URL: python_x509_pkcs11-0.1.6.tar.gz
- Upload date:
- Size: 9.4 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/4.0.1 CPython/3.9.2
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | ecf26c45a86b7eeb1b12588c0de1f8c46ea2f366525acaf565d35650c59a0c12 |
|
| MD5 | be86fccf99de854608e16f196d850f77 |
|
| BLAKE2b-256 | 0594bc661df53718193b6ff3eaf30ac2e4495d2e479de95cf6c937398c3e5c0b |
File details
Details for the file python_x509_pkcs11-0.1.6-py3-none-any.whl.
File metadata
- Download URL: python_x509_pkcs11-0.1.6-py3-none-any.whl
- Upload date:
- Size: 11.0 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/4.0.1 CPython/3.9.2
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 7424d4e7de5c061ad120a903cb61d82037148985ec3ba7a118aca9b6b48cc0cb |
|
| MD5 | 688adeca0a7ea66a6cb4acba17615923 |
|
| BLAKE2b-256 | accc23100142ef886319d7500acdd319249fcb938ff25e5246806bda587d6e09 |
