How to interface with PKCS#11 compliant HSM device in PHP

Question

How can I use key material from a PKCS#11 compliant HSM (for example a SafeNet iKey 2032 [USB] or a Aladdin eToken PRO [USB]) in PHP application running on a Linux server?

Answer 1

I have not seen, and a cursory search has not found, a PCKS#11 glue library for PHP. Probably not the answer you're looking for. (: If you have better search fu than I, do update this thread.

I think your best bet would be to write a C program that calls PKCS#11 and accesses the HSM, and call that from your PHP app as an external binary. Even if a PKCS#11 wrapper emerges for PHP, this approach will give you the full API available to the C code rather than having to make do with whatever the author of the wrapper needed to satisfy their own requirements. PKCS#11 is a large API, and wrapper implementations are often less than complete.