title: Sign certificate in PKCS#11
body: <p>To sign certificate in OpenSSL I use <code>X509_sign()</code> function by feeding it with a request (as <code>X509_REQ*</code>), a signing key and a digest. </p>
  
  <p>Now I have my signing key stored in HSM, so I can't extract it to sign the certificate. Unfortunately PKCS#11 does not provide an equivalent to <code>X509_sign()</code>. All it has is <code>C_Sign() / C_SignUpdate() / C_SignFinal()</code> family of functions which operate on raw data, not on certificates. </p>
  
  <p>Can someone help me with sample C/C++ code how to use PKCS#11 to sign a certificate created with OpenSSL?</p>