Disambiguating certificates in a PCKS#11 token

It is more like a help building code for sign a pdf document using my USB token (self signed certificate).

The signature on output file is corrupted. Im using the test code bellow with your pdf template (minimal-with-field_signed.pdf):

from pyhanko.sign import signers, pkcs11
from pyhanko.sign import timestamps
from pyhanko.pdf_utils.incremental_writer import IncrementalPdfFileWriter

PKCS11LIB='C:\\Windows\\System32\\eTPKCS11.dll'
SERIALTOKEN=b'xxxxxxxx'
LABEL='xxxxxxxxxxx'
PIN='xxxxxxxxxx'
EXTENSION=".pdf"
DOCUMENT='C:\\Users\\vinicius\\Desktop\\minimal-with-field'
DOCUMENT_EXT=DOCUMENT+EXTENSION
SIGNED_FILE = DOCUMENT+"_signed.pdf"

cms_session = pkcs11.open_pkcs11_session(PKCS11LIB,user_pin=PIN,token_label=LABEL)
cms_signer = pkcs11.PKCS11Signer(cms_session,'')

with open(DOCUMENT_EXT, 'rb') as doc:
    w = IncrementalPdfFileWriter(doc)
    print(w.document_id)
    with open(SIGNED_FILE, 'wb+') as file_out:    
        signers.PdfSigner(signers.PdfSignatureMetadata(field_name='Sig1'),signer=cms_signer).sign_pdf(w,output=file_out)

The code is able to get my certificate data, as the signature (visible text) shows without any trouble, but the signature comes corrupted as shown bellow:

btw, nice job with this library! tks in advance

[MatthiasValvekens]

I added a by-ID selection mechanism in the commit linked above, which should fix this issue in the public API as well. Thanks for reporting back on what made it work for you!

PS: I learned that even IDs don’t necessarily uniquely identify an object in PKCS#11. For example, on the YubiKey that I experimented with, every key generated on-device has two certificates associated with it with the same ID (a “regular” cert, and an attestation cert). So in some situations you might indeed have to pass both the label and the ID.

[vtgdias]

I was able to get it working using get_objects() with Attribute.ID (had to pass label as ‘’ too)! Tks for your help.