eclipse-paho / eclipse-paho/paho.mqtt.python

Any support for PKCS#11 compatible Hardware Security Module (HSM)?

Open
#646 3 comments 0 reactions 0 assignees View on GitHub
Status: Available Type: Enhancement
Dominant language
Python
Stars
2.4k
Forks
742
Avg merge
12d 48m
Merged PRs (30d)
1

Description

Hello. Does paho.mqtt support a PKCS#11 compatible Hardware Security Module (HSM)?

My device private key is currently stored in HSM or softHSM2. According to the documentation, `keyfile` is a string pointing to the PEM encoded private key.

Since device's private key is stored inside HSM, its private key cannot be retrieved. Is there any workaround to support HSM instead of using PEM encoded file from local storage? Thanks in-advance☺

```python
...
# Using PEM encoded file
client.tls_set(
ca_certs=PATH_TO_ROOT_CERT,
certfile=CERT_FILE,
keyfile="./device-private-key.pem",
cert_reqs=ssl.CERT_REQUIRED,
tls_version=ssl.PROTOCOL_TLSv1_2,
ciphers=None,
)
```

```python
...
# Using HSM or softHSM2 with PKCS#11
client.tls_set(
ca_certs=PATH_TO_ROOT_CERT,
certfile=CERT_FILE,
keyfile="pkcs11:object=deviceprivkey;type=private;pin-value=mypin",
cert_reqs=ssl.CERT_REQUIRED,
tls_version=ssl.PROTOCOL_TLSv1_2,
ciphers=None,
)
```

### References
[AWS IoT MQTT with PKCS#11 support][aws-iot-mqtt-pkcs]

[aws-iot-mqtt-pkcs]: https://github.com/aws/aws-iot-device-sdk-python-v2/tree/main/samples#pkcs11-pubsub

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.