def cms_sign_data(data_to_sign, signing_cert_file_name, signing_key_file_name, outform=PKI_ASN1_FORM, message_digest=DEFAULT_TOKEN_DIGEST_ALGORITHM):
 _ensure_subprocess()
 if isinstance(data_to_sign, six.string_types):
  data = bytearray(data_to_sign, encoding='utf-8')
 else:
  data = data_to_sign
 process = subprocess.Popen(['openssl', 'cms', '-sign', '-signer', signing_cert_file_name, '-inkey', signing_key_file_name, '-outform', 'PEM', '-nosmimecap', '-nodetach', '-nocerts', '-noattr', '-md', message_digest], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, close_fds=True)
 (output, err, retcode) = _process_communicate_handle_oserror(process, data, (signing_cert_file_name, signing_key_file_name))
 if ((retcode != OpensslCmsExitStatus.SUCCESS) or ('Error' in err)):
  if (retcode == OpensslCmsExitStatus.CREATE_CMS_READ_MIME_ERROR):
   LOG.error(_LE('Signing error: Unable to load certificate - ensure you have configured PKI with "keystone-manage pki_setup"'))
  else:
   LOG.error(_LE('Signing error: %s'), err)
  raise subprocess.CalledProcessError(retcode, 'openssl')
 if (outform == PKI_ASN1_FORM):
  return output.decode('utf-8')
 else:
  return output

def cms_sign_data ( data_to_sign , signing_cert_file_name , signing_key_file_name , outform = PKI_ASN1_FORM , message_digest = DEFAULT_TOKEN_DIGEST_ALGORITHM ) : _ensure_subprocess ( ) if isinstance ( data_to_sign , six . string_types ) : data = bytearray ( data_to_sign , encoding = 'utf-8' ) else : data = data_to_sign process = subprocess . Popen ( [ 'openssl' , 'cms' , '-sign' , '-signer' , signing_cert_file_name , '-inkey' , signing_key_file_name , '-outform' , 'PEM' , '-nosmimecap' , '-nodetach' , '-nocerts' , '-noattr' , '-md' , message_digest ] , stdin = subprocess . PIPE , stdout = subprocess . PIPE , stderr = subprocess . PIPE , close_fds = True ) ( output , err , retcode ) = _process_communicate_handle_oserror ( process , data , ( signing_cert_file_name , signing_key_file_name ) ) if ( ( retcode != OpensslCmsExitStatus . SUCCESS ) or ( 'Error' in err ) ) : if ( retcode == OpensslCmsExitStatus . CREATE_CMS_READ_MIME_ERROR ) : LOG . error ( _LE ( 'Signing error: Unable to load certificate - ensure you have configured PKI with "keystone-manage pki_setup"' ) ) else : LOG . error ( _LE ( 'Signing error: %s' ) , err ) raise subprocess . CalledProcessError ( retcode , 'openssl' ) if ( outform == PKI_ASN1_FORM ) : return output . decode ( 'utf-8' ) else : return output
use openssl to sign a document .