You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Please support specifying tokens/keys using the standard RFC7512 URI format.
Well-behaved applications supporting e.g. client SSL certificates ought to automatically accept a PKCS#11 URI specifying the key and/or certificate to be used. All the user needs to do is give e.g. pkcs11:manufacturer=piv_II;id=%01 in place of a filename, and it should work.
It is not clear how an application author could achieve this using crypto11. I'd like to see a simple function which takes a URI (or pair of URIs for cert and key if they need separate identifiers), and returns the cert and Signer objects.
It should use the system p11-kit-proxy.so provider by default, and load the providers which are correctly configured in the system. Nothing but the URI should be needed in the normal case.
Please support specifying tokens/keys using the standard RFC7512 URI format.
Well-behaved applications supporting e.g. client SSL certificates ought to automatically accept a PKCS#11 URI specifying the key and/or certificate to be used. All the user needs to do is give e.g.
pkcs11:manufacturer=piv_II;id=%01
in place of a filename, and it should work.It is not clear how an application author could achieve this using crypto11. I'd like to see a simple function which takes a URI (or pair of URIs for cert and key if they need separate identifiers), and returns the cert and
Signer
objects.It should use the system
p11-kit-proxy.so
provider by default, and load the providers which are correctly configured in the system. Nothing but the URI should be needed in the normal case.See https://www.infradead.org/openconnect/pkcs11.html for example user documentation for what I considered a "well-behaved application" where PKCS#11 "Just Works".
The text was updated successfully, but these errors were encountered: