Signing XML (XML-DSig) using HSM and PKCS11 token in .Net Core 7.0

Question

I have X509 certificate which contains public key only in my database. The corresponding private key is store inside HSM. I found out that SignedXml class in .NET does not support signing XML in HSM.

Is there any other alternative? A replacement for SignedXml or other option that I can use to achieve this ?

Answer 1

You can use Pkcs11Interop.X509Store library which provides easy to use PKCS#11 based X.509 certificate store and contains Pkcs11RsaProvider class inherited from System.Security.Cryptography.RSA class that you can use as a SigningKey with SignedXml class.

There's also a code sample available which demonstrates your use case.