Skip to content

RFC7512 URI support #104

@dwmw2

Description

@dwmw2

Please support specifying tokens/keys using the standard RFC7512 URI format.

Well-behaved applications supporting e.g. client SSL certificates ought to automatically accept a PKCS#11 URI specifying the key and/or certificate to be used. All the user needs to do is give e.g. pkcs11:manufacturer=piv_II;id=%01 in place of a filename, and it should work.

It is not clear how an application author could achieve this using crypto11. I'd like to see a simple function which takes a URI (or pair of URIs for cert and key if they need separate identifiers), and returns the cert and Signer objects.

It should use the system p11-kit-proxy.so provider by default, and load the providers which are correctly configured in the system. Nothing but the URI should be needed in the normal case.

See https://www.infradead.org/openconnect/pkcs11.html for example user documentation for what I considered a "well-behaved application" where PKCS#11 "Just Works".

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions