[Python] How do I digitally sign a PDF file using a physical PKI card from Python?

I'm trying to create an app where the user will fill a form and a PDF template will be filled with that info, then get digitally signed and sent via e-mail.

I have been trying to sign with PyHanko, but no luck so far. It seems it only likes to work with stored digital certificates and not with physical cards and card readers. For now, I put together a little snippet that accesses the card using PyPKCS11 and lists everything it finds inside:

import PyKCS11
import tkinter as tk
import customtkinter as ctk

# Path to Nexus Personal's PKCS#11 driver
pkcs11_lib = r"C:\Program Files (x86)\Personal\bin64\personal64.dll"

# Load lib
pkcs11 = PyKCS11.PyKCS11Lib()
pkcs11.load(pkcs11_lib)

# Dialog asking for PIN
root = tk.Tk()
root.withdraw()
pin = ctk.CTkInputDialog(title="pin", text="Introduce el PIN de tu tarjeta:").get_input()
root.destroy()

# Start session in pin-pointed slot (probably not very universal)
slots = pkcs11.getSlotList(tokenPresent=True)
session = pkcs11.openSession(slots[1])
session.login(pin)

# List objects
for obj in session.findObjects():
attr = session.getAttributeValue(obj, [PyKCS11.CKA_CLASS, PyKCS11.CKA_LABEL])
print(attr)

'''
Listed objects:
[2, 'Encryption']
[1, '']
[2, '']
[1, '']
[2, '']
[1, '']
[2, '']
[1, '']
[2, '']
[3, 'Digital Signature']
[3, 'Encryption']
[0, 'Card Serial Number']
[0, 'Chip Serial Number']
[0, 'Card Eraser']
'''

session.logout()
session.closeSession()

Continue reading...