Support PKCS#11 for mutual TLS on Unix platforms

aws / aws-iot-device-sdk-python-v2

Next generation AWS IoT Client SDK for Python using the AWS Common Runtime

Apache License 2.0

410 stars 212 forks source link

Support PKCS#11 for mutual TLS on Unix platforms #248

Closed crestid closed 2 years ago

crestid commented 3 years ago

Is your feature request related to a problem? Please describe. Python SDK (awscrt.io) not providing PKCS11 support for TlsContextOptions. Requirement is to have a way to establish an MQTT connection using an HSM module with PKCS11 compliant libraries.

Describe the solution you'd like A way to establish a connection using the mqtt_connection_builder that allows using an HSM cryptographic module instead of certificate/pvt key as files or bytearrays

Describe alternatives you've considered As of today, the alternative will require the customer to develop their own fork of the connection builder libraries. Worst case scenario, not using an HSM

jmklix commented 3 years ago

Thanks for making this feature request. This is something we are planning on adding, but I can't give an exact timeline for when it will be added.

graebm commented 2 years ago

PKCS#11 integration is available in the latest version: 1.8.0 Currently, it's only available on Unix devices (not Windows or Apple).

Use the following function to set it up: mqtt_connection_builder.mtls_with_pkcs11()

There's a new pkcs11_pubsub.py sample program for testing it out. Documentation on running the sample with SoftHSM can be found here.

github-actions[bot] commented 2 years ago

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.