Allow load_cert_chain to load cert from token

Feature or enhancement

Proposal:

I wanted to implement security token support for ansible but when I digged I saw the missing feature was in python stdlib https://github.com/ansible/ansible/blob/2bb09bfd12e42e7be6f39ab0e45a992512c240f9/lib/ansible/module_utils/urls.py#L505

I can use curl with -E 'pkcs11:model=... it recognize it is not a local file and still can access to pointed file. I configured my openssl to load pkcs11 engine. https://docs.digicert.com/en/software-trust-manager/sign-with-digicert-signing-tools/third-party-signing-tool-integrations/configure-openssl-for-signing-with-pkcs11.html
I can assist anyone wanting help to setup and see the bug.
It seems this code is helpful:
https://github.com/curl/curl/blob/master/lib/vtls/openssl.c#L1339-L1398

I think the error is here:
https://github.com/python/cpython/blob/a9c304cf020e2fa3ae78fd88359dfc808c9dd639/Modules/_ssl.c#L3892-L3898
this function only load file. I can't find it definition in github code search

I understand pkcs11 token might not be widely available and I am willing to contribute. Have you any pointer ? Does python use openssl or I have to resort to dynamic loading like this gist https://gist.github.com/klali/3a20c28c0fc78c924756bfb94b498f1c ?

Has this already been discussed elsewhere?

No response given

Links to previous discussion of this feature:

No response

Commencez par lire l’implémentation de load_cert_chain dans Modules/_ssl.c, en particulier le code de chargement des fichiers aux lignes référencées, et comparez le chemin OpenSSL de curl et l’appelant Ansible afin de déterminer le comportement attendu des tokens. Déterminez l’API prise en charge et l’intégration OpenSSL nécessaires pour les emplacements PKCS#11 ; la tâche sera considérée comme terminée lorsqu’une conception approuvée et une couverture du chargement d’un certificat depuis un token existeront.