title: Simplest way to cryptographically sign a file and output in CMS format with a PKCS11 provider?
body: <p>I am looking for the simplest way to sign a given file and get the output in CMS format, but this must be using a PKCS11 provider as the private key for signing is on a smartcard.</p>
  
  <p>I can get a signed file of the right format from the command line with openssl (but note this is getting the certificate from a file and not the smartcard)</p>
  
  <p><code> 
  openssl cms -sign -in sign.txt -out signout.txt -signer signer.pem -outform DER
  </code></p>
  
  <p>I would like to do this from code using the thinnest wrapper possible.  I could use the openssl library but to support pkcs11 you need to wire up through an engine (opensc have one) but then it starts getting very big.  It strikes me that there must be a simple wrapper over PKCS11 available somewhere.</p>
  
  <p>I am happy if the wrapper is in 'C' or .net.
  I can call the PKCS11 provider myself and do the signing, if I knew how to output as CMS so maybe a library to do this is enough?</p>
  
  <p>Best wishes
  James</p>