diff --git a/pkgs/tools/security/softhsm/default.nix b/pkgs/tools/security/softhsm/default.nix
new file mode 100644
index 0000000000000..f30181e93ba40
--- /dev/null
+++ b/pkgs/tools/security/softhsm/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, fetchurl, unzip, botan }:
+
+stdenv.mkDerivation rec {
+
+  name = "softhsm-${version}";
+  majorVersion = "2";
+  version = "${majorVersion}.0.0";
+
+  src = fetchurl {
+    url = "https://dist.opendnssec.org/source/${name}.tar.gz";
+    sha256 = "eae8065f6c472af24f4c056d6728edda0fd34306f41a818697f765a6a662338d";
+  };
+
+  configureFlags = [
+    "--with-crypto-backend=botan"
+    "--with-botan=${botan}"
+    "--sysconfdir=$out/etc"
+    "--localstatedir=$out/var"
+    ];
+
+  buildInputs = [ botan];
+
+  meta = {
+    homepage = https://www.opendnssec.org/softhsm/;
+    description = "cryptographic store accessible through a PKCS #11 interface";
+    license = stdenv.lib.licenses.bsd;
+    maintainers = with stdenv.lib.maintainers; [];
+    platforms = with stdenv.lib.platforms.linux; 
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7de5ad294a351..cc7f2b2fa9a5d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3068,6 +3068,8 @@ let
 
   snort = callPackage ../applications/networking/ids/snort { };
 
+  softhsm = callPackage ../tools/security/softhsm { };
+
   solr = callPackage ../servers/search/solr { };
 
   solvespace = callPackage ../applications/graphics/solvespace { };