eclipse-paho / eclipse-paho/paho.mqtt.python
Any support for PKCS#11 compatible Hardware Security Module (HSM)?
- Dominant language
- Python
- Stars
- 2.4k
- Forks
- 742
- Avg merge
- 12d 48m
- Merged PRs (30d)
- 1
Description
Hello. Does paho.mqtt support a PKCS#11 compatible Hardware Security Module (HSM)?
My device private key is currently stored in HSM or softHSM2. According to the documentation, `keyfile` is a string pointing to the PEM encoded private key.
Since device's private key is stored inside HSM, its private key cannot be retrieved. Is there any workaround to support HSM instead of using PEM encoded file from local storage? Thanks in-advance☺
```python
...
# Using PEM encoded file
client.tls_set(
ca_certs=PATH_TO_ROOT_CERT,
certfile=CERT_FILE,
keyfile="./device-private-key.pem",
cert_reqs=ssl.CERT_REQUIRED,
tls_version=ssl.PROTOCOL_TLSv1_2,
ciphers=None,
)
```
```python
...
# Using HSM or softHSM2 with PKCS#11
client.tls_set(
ca_certs=PATH_TO_ROOT_CERT,
certfile=CERT_FILE,
keyfile="pkcs11:object=deviceprivkey;type=private;pin-value=mypin",
cert_reqs=ssl.CERT_REQUIRED,
tls_version=ssl.PROTOCOL_TLSv1_2,
ciphers=None,
)
```
### References
[AWS IoT MQTT with PKCS#11 support][aws-iot-mqtt-pkcs]
[aws-iot-mqtt-pkcs]: https://github.com/aws/aws-iot-device-sdk-python-v2/tree/main/samples#pkcs11-pubsub
Contributor guide
Assessment
This issue has not been assessed yet.