Package: python-x509-pkcs11
python_x509_pkcs11Seamless async signing x509 using PKCS11 device for key storageCurrently supportsCreating root CAs and generating their keys in the PKCS11 device.Using the keys in the PKCS11 device to sign certificates or Intermediate CAs.Creating certificates, CSRs, CRLs, OCSPs  with the PKCS11 device keys enabling a full PKI infrastructure.'Advanced' handling of fragile persistent PKCS11 sessions, including recreating the session if PKCS11 operation timeout.This package is heavily uses python-pkcs11 and asn1crypto.Package is async but python-pkcs11 is unfortunately still sync, probably due to the fragile nature of PKCS11.Tested with SoftHSM and LUNAHSM.Setup# Install libs and add your user to the softhsm group# You should probably replace softhsm when using this in production, any PKCS11 device should workifawk-F='/^NAME/{print $2}'/etc/os-release|grep-i"debian\|ubuntu"then# Ubuntu / Debiansudoapt-getinstallpython3-devpython3-pipsofthsm2sudousermod-a-Gsofthsm$USERelse# Redhat / Centos / Fedorasudodnfinstallpython3-develpython3-pipsofthsmgccsudousermod-a-Gods$USERfi# Update your softhsm group membershipexecsudosu-l$USER# Install this packagepip3installpython_x509_pkcs11# export env values the code will useifawk-F='/^NAME/{print $2}'/etc/os-release|grep-i"debian\|ubuntu"thenexportPKCS11_MODULE="/usr/lib/softhsm/libsofthsm2.so"elseexportPKCS11_MODULE="/usr/lib64/softhsm/libsofthsm.so"fiexportPKCS11_PIN="1234"exportPKCS11_TOKEN="my_test_token_1"# Initialize the tokensofthsm2-util--init-token--slot0--label$PKCS11_TOKEN--pin$PKCS11_PIN--so-pin$PKCS11_PINUsageLook at thedocumentationfor quick examples to begin.Thetestsare also a good starting pointHere is the basic, create a root CA and then use its key in the PKCS11 device to sign a csr:# export env values the code will useifawk-F='/^NAME/{print $2}'/etc/os-release|grep-i"debian\|ubuntu"thenexportPKCS11_MODULE="/usr/lib/softhsm/libsofthsm2.so"elseexportPKCS11_MODULE="/usr/lib64/softhsm/libsofthsm.so"fiexportPKCS11_PIN="1234"exportPKCS11_TOKEN="my_test_token_1"# Delete the previous token if existssofthsm2-util--delete-token--token$PKCS11_TOKEN# Initialize a new fresh PKCS11 tokensofthsm2-util--init-token--slot0--label$PKCS11_TOKEN--pin$PKCS11_PIN--so-pin$PKCS11_PINimportasynciofrompython_x509_pkcs11.caimportcreateasyncdefmy_func()->None:root_ca_name_dict={"country_name":"SE","state_or_province_name":"Stockholm","locality_name":"Stockholm","organization_name":"SUNET","organizational_unit_name":"SUNET Infrastructure","common_name":"ca-test.sunet.se","email_address":"soc@sunet.se",}# key_type must be:# [ed25519](https://en.wikipedia.org/wiki/EdDSA). This is default.# ed448# secp256r1# secp384r1# secp521r1# rsa_2048# rsa_4096csr_pem,root_cert_pem=awaitcreate("my_ed25519_key",root_ca_name_dict,key_type="ed25519")print("CSR which was self-signed into root CA")print(csr_pem)print("root CA")print(root_cert_pem)asyncio.run(my_func())Contributing / Tests# installifawk-F='/^NAME/{print $2}'/etc/os-release|grep-i"debian\|ubuntu"then# Ubuntu / Debiansudoapt-getinstallflitpython3-mypyblackpylintelse# Redhat / Centos / Fedorasudodnfinstallepel-releasesudodnfinstallpython3-flitpython3-mypypython3-blackpylintfi# Make your code changes# Then in the root folder, where this README isbashdeploy.sh# Build the package with flitflitbuild