Allow load_cert_chain to load cert from token

Feature or enhancement

Proposal:

I wanted to implement security token support for ansible but when I digged I saw the missing feature was in python stdlib https://github.com/ansible/ansible/blob/2bb09bfd12e42e7be6f39ab0e45a992512c240f9/lib/ansible/module_utils/urls.py#L505

I can use curl with -E 'pkcs11:model=... it recognize it is not a local file and still can access to pointed file. I configured my openssl to load pkcs11 engine. https://docs.digicert.com/en/software-trust-manager/sign-with-digicert-signing-tools/third-party-signing-tool-integrations/configure-openssl-for-signing-with-pkcs11.html
I can assist anyone wanting help to setup and see the bug.
It seems this code is helpful:
https://github.com/curl/curl/blob/master/lib/vtls/openssl.c#L1339-L1398

I think the error is here:
https://github.com/python/cpython/blob/a9c304cf020e2fa3ae78fd88359dfc808c9dd639/Modules/_ssl.c#L3892-L3898
this function only load file. I can't find it definition in github code search

I understand pkcs11 token might not be widely available and I am willing to contribute. Have you any pointer ? Does python use openssl or I have to resort to dynamic loading like this gist https://gist.github.com/klali/3a20c28c0fc78c924756bfb94b498f1c ?

Has this already been discussed elsewhere?

No response given

Links to previous discussion of this feature:

No response

首先阅读 Modules/_ssl.c 中的 load_cert_chain 实现，尤其是所引用行中的文件加载代码，并比较 curl 的 OpenSSL 路径和 Ansible 调用方，以确定预期的令牌行为。确定 PKCS#11 位置所需的受支持 API 和 OpenSSL 集成；完成标准是具备用于从令牌加载证书的既定设计和覆盖。