-
Notifications
You must be signed in to change notification settings - Fork 90
Description
Please support specifying tokens/keys using the standard RFC7512 URI format.
Well-behaved applications supporting e.g. client SSL certificates ought to automatically accept a PKCS#11 URI specifying the key and/or certificate to be used. All the user needs to do is give e.g. pkcs11:manufacturer=piv_II;id=%01 in place of a filename, and it should work.
It is not clear how an application author could achieve this using crypto11. I'd like to see a simple function which takes a URI (or pair of URIs for cert and key if they need separate identifiers), and returns the cert and Signer objects.
It should use the system p11-kit-proxy.so provider by default, and load the providers which are correctly configured in the system. Nothing but the URI should be needed in the normal case.
See https://www.infradead.org/openconnect/pkcs11.html for example user documentation for what I considered a "well-behaved application" where PKCS#11 "Just Works".