This module allows to use a Nitrokey NetHSM as a backend for PKCS#11 operations.
See the list of supported features for more details.
Download the latest binary from the release page.
Follow the documentation for usage instructions.
Set the RUST_LOG
env variable to trace
, debug
, info
, warn
or err
to change the logging level.
For testing and development purposes there are two examples using the PKCS11 driver with Nginx and Apache.
They require each a certificate built with the container/<server>/generate.sh
.
They can be built with:
# Building the images
docker build -t nginx-testing -f container/nginx/Dockerfile .
docker build -t apache-testing -f container/apache/Dockerfile .
Assuming that a NetHSM is runnig on localhost:8443, they can then be run with :
docker run --net=host nginx-testing:latest
docker run --net=host apache-testing:latest
The NetHSM is expected to have be provisionned with the following configuration:
nitropy nethsm --host localhost:8443 --no-verify-tls provision -u 0123456789 -a Administrator
nitropy nethsm --host localhost:8443 --no-verify-tls add-user -n Operator -u operator -p opPassphrase -r Operator
Required are gcc
and a working Rust toolchain of at least version (MSRV) 1.70.
cargo build --release
The dynamic library will be in ${CARGO_TARGET_DIR:-target}/release/libnethsm_pkcs11.so
.
You need to install musl-dev
and gcc
:
apk add musl-dev gcc
To build on Alpine Linux you will need to add the C argument target-feature=-crt-static
:
RUSTFLAGS="-C target-feature=-crt-static" cargo build --release