Add support for SmartCard-HSM Cloud Service

[CardContact]

Following the discussion about accessing a remote SmartCard-HSM, we have created a SmartCard-HSM Cloud Service that can be deployed as a sidecar to allow other cloud services to access the keys on a remotely connected device.

We'd love to add support for step-ca and are looking for the right entry-point in the step-kms-plugin.

Unfortunately we are not (yet) fluent in go, but at least we were able to create a go client using the openapi-generator.

Where is the best point to start with an integration ?

[maraino]

I think is possible for you to add support if you compile a custom version of step-ca or step-kms-plugin.

A Go package with your implementation can register a KMS using apiv1.Register. This will add that implementation available in go.step.sm/crypto. Then if step-ca or step-kms-plugin is compiled with that version of go.step.sm/crypto, using a replace in go.mod or in a go.work, your kms will be available there.

You can also do it without replaces if you import your package in a file that you pass to the compiler, e.g. go build -o step-kms-plugin main.go main_sc.go, that last file just need an import of your package like this:

package main

import _ "url.to/your/package"

You will need to implement all KeyManager methods, although CreateKey and perhaps GetPublicKey might not be necessary to run step-ca, but you need to define them.