README: document cloud PKCS#11 modules (Certum SimplySign example) - #501
Merged
Merged
Conversation
Add a section alongside the existing engine and provider ones, covering PKCS#11 modules backed by a signing service's own HSM, with Certum SimplySign via the third-party ssign-pkcs11 as the example. Shows both the -provider and -engine invocations, and notes that either may be omitted since osslsigncode tries pkcs11prov before the libp11 engine.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request Type
Related Issue
Issue number: #498
Current Behavior
The README documents PKCS#11 use with a local token (SoftHSM, OpenSC) through
either the engine or the provider. Cloud signing services that ship their own
PKCS#11 module work the same way, but nothing says so, so it is not obvious
that
osslsigncodealready covers them.New Behavior
A short section on cloud PKCS#11 modules, following the existing engine and
provider sections, with Certum SimplySign via ssign-pkcs11 as the example.
Scope of Changes
One new section in README.md, no code. It notes explicitly that ssign-pkcs11 is
an independent third-party project, not affiliated with or endorsed by
osslsigncode. Both the
-providerand-engineforms are shown, plus the factthat either may be omitted since
osslsigncodetriespkcs11provfirst andfalls back to the libp11
pkcs11engine.I am the author of ssign-pkcs11, so treat the wording as a proposal — happy to
cut it down, drop the project link, or move it to osslsigncode.md instead.
Testing
Checked against osslsigncode 2.13 / OpenSSL 3.5.5 on Debian, with a real
Certum certificate: all three forms shown or mentioned here (
-provider,-engine, and neither) signed and verified a file end to end, using the samepkcs11:type=cert/pkcs11:type=privateURIs as in the examples.Note the paths in the examples follow the
/usr/lib64/...convention alreadyused in the surrounding sections rather than the Debian ones I tested with.
Additional Notes
No behaviour change; docs only.
License Declaration