diff --git a/security/softhsm2/DESCR b/security/softhsm2/DESCR
new file mode 100644
index 000000000000..5282e11fad9c
--- /dev/null
+++ b/security/softhsm2/DESCR
@@ -0,0 +1,4 @@
+SoftHSM is an implementation of a cryptographic store accessible through a
+PKCS#11 interface. You can use it to explore PKCS#11 without having a
+Hardware Security Module. It is being developed as a part of the OpenDNSSEC
+project. SoftHSM uses Botan for its cryptographic operations.
diff --git a/security/softhsm2/Makefile b/security/softhsm2/Makefile
new file mode 100644
index 000000000000..2418a9a07f7c
--- /dev/null
+++ b/security/softhsm2/Makefile
@@ -0,0 +1,48 @@
+# $NetBSD: Makefile,v 1.1 2019/11/06 10:11:41 he Exp $
+#
+
+VERSION=	2.5.0
+DISTNAME=	softhsm-${VERSION}
+PKGNAME=	softhsm2-${VERSION}
+CATEGORIES=	security
+MASTER_SITES=	http://www.opendnssec.org/files/source/
+
+MAINTAINER=	he@NetBSD.org
+HOMEPAGE=	http://www.opendnssec.org/softhsm/
+COMMENT=	Cryptographic store accessible through a PKCS\#11 interface
+LICENSE=	2-clause-bsd
+
+BUILD_DEFS+=	VARBASE
+
+USE_LANGUAGES=	c c++
+USE_LIBTOOL=	yes
+
+GNU_CONFIGURE=		yes
+CONFIGURE_ARGS+=	--localstatedir=${VARBASE}
+CONFIGURE_ARGS+=	--with-botan=${PREFIX}
+CONFIGURE_ARGS+=	--with-objectstore-backend-db
+CONFIGURE_ARGS+=	--with-migrate
+
+EGDIR=			${PREFIX}/share/examples/softhsm
+
+SUBST_CLASSES+=         paths
+SUBST_FILES.paths=      ${WRKSRC}/src/lib/common/Makefile.in
+SUBST_STAGE.paths=      pre-configure
+SUBST_VARS.paths= 	EGDIR
+
+CXXFLAGS.NetBSD+=	-D_NETBSD_SOURCE
+# For debugging:
+CXXFLAGS+=		-g
+INSTALL_UNSTRIPPED=	YES
+
+CONF_FILES=		${EGDIR}/softhsm2.conf ${PKG_SYSCONFDIR}/softhsm2.conf
+
+INSTALLATION_DIRS=	${EGDIR} etc bin lib
+OWN_DIRS=		${VARBASE}/softhsm
+
+pre-install:
+	${INSTALL_DATA} ${WRKSRC}/src/lib/common/softhsm2.conf ${DESTDIR}${EGDIR}
+
+.include "../../databases/sqlite3/buildlink3.mk"
+.include "../../security/botan/buildlink3.mk"
+.include "../../mk/bsd.pkg.mk"
diff --git a/security/softhsm2/PLIST b/security/softhsm2/PLIST
new file mode 100644
index 000000000000..db267609fdaa
--- /dev/null
+++ b/security/softhsm2/PLIST
@@ -0,0 +1,15 @@
+@comment $NetBSD: PLIST,v 1.1 2019/11/06 10:11:41 he Exp $
+bin/softhsm2-dump-db
+bin/softhsm2-dump-file
+bin/softhsm2-keyconv
+bin/softhsm2-migrate
+bin/softhsm2-util
+lib/softhsm/libsofthsm2.la
+man/man1/softhsm2-dump-db.1
+man/man1/softhsm2-dump-file.1
+man/man1/softhsm2-keyconv.1
+man/man1/softhsm2-migrate.1
+man/man1/softhsm2-util.1
+man/man5/softhsm2.conf.5
+share/examples/softhsm/softhsm2.conf
+@pkgdir etc
diff --git a/security/softhsm2/buildlink3.mk b/security/softhsm2/buildlink3.mk
new file mode 100644
index 000000000000..376c3893247d
--- /dev/null
+++ b/security/softhsm2/buildlink3.mk
@@ -0,0 +1,16 @@
+# $NetBSD: buildlink3.mk,v 1.1 2019/11/06 10:11:41 he Exp $
+
+BUILDLINK_TREE+=	softhsm2
+
+.if !defined(SOFTHSM2_BUILDLINK3_MK)
+SOFTHSM2_BUILDLINK3_MK:=
+
+BUILDLINK_API_DEPENDS.softhsm2+=	softhsm2>=2.0.0
+BUILDLINK_ABI_DEPENDS.softhsm2+=	softhsm2>=2.0.0
+BUILDLINK_PKGSRCDIR.softhsm2?=	../../security/softhsm2
+
+.include "../../databases/sqlite3/buildlink3.mk"
+.include "../../security/botan/buildlink3.mk"
+.endif	# SOFTHSM2_BUILDLINK3_MK
+
+BUILDLINK_TREE+=	-softhsm2
diff --git a/security/softhsm2/distinfo b/security/softhsm2/distinfo
new file mode 100644
index 000000000000..bc894743b6e2
--- /dev/null
+++ b/security/softhsm2/distinfo
@@ -0,0 +1,9 @@
+$NetBSD: distinfo,v 1.1 2019/11/06 10:11:41 he Exp $
+
+SHA1 (softhsm-2.5.0.tar.gz) = 9b1072d9e12e1834e4f9518ec60a3e38aa92bc09
+RMD160 (softhsm-2.5.0.tar.gz) = 652beae56eb85bb864df45e89fcb1ddf84276d6d
+SHA512 (softhsm-2.5.0.tar.gz) = a1e686729196dc25591eb3da57c2c8ea8494ed274ba711842b2dcae696f477a202acda13a975b8fb1eb68e8e44a79e839dbbc6ba500cab02ad13072c660752d9
+Size (softhsm-2.5.0.tar.gz) = 1078439 bytes
+SHA1 (patch-configure) = 220881a76fa84e8ba6a81c902bdfd07bc6af88bd
+SHA1 (patch-configure.ac) = 5d1d5134e580f1310446da4323c0e1c65b6115de
+SHA1 (patch-src_lib_common_Makefile.in) = ca783cdfdb4d16eece5fd21d02033e71968d00c6
diff --git a/security/softhsm2/patches/patch-configure b/security/softhsm2/patches/patch-configure
new file mode 100644
index 000000000000..178c9f79c6a0
--- /dev/null
+++ b/security/softhsm2/patches/patch-configure
@@ -0,0 +1,15 @@
+$NetBSD: patch-configure,v 1.1 2019/11/06 10:11:41 he Exp $
+
+Use /var/db not /var/lib, to adhere to NetBSD hier(7).
+
+--- configure.orig	2018-09-24 07:52:05.000000000 +0000
++++ configure
+@@ -8495,7 +8495,7 @@ full_sysconfdir=`eval eval eval eval eva
+ full_localstatedir=`eval eval eval eval eval echo "${localstatedir}" | sed "s#NONE#${prefix}#" | sed "s#NONE#${ac_default_prefix}#"`
+ full_libdir=`eval eval eval eval eval echo "${libdir}" | sed "s#NONE#${prefix}#" | sed "s#NONE#${ac_default_prefix}#"`
+ default_softhsm2_conf="`eval echo ${full_sysconfdir} | sed s,NONE,$ac_default_prefix,g`/softhsm2.conf"
+-softhsmtokendir=${full_localstatedir}/lib/softhsm/tokens/
++softhsmtokendir=${full_localstatedir}/db/softhsm/tokens/
+ 
+ # Install the library in a sub-directory
+ full_libdir="$full_libdir/softhsm"
diff --git a/security/softhsm2/patches/patch-configure.ac b/security/softhsm2/patches/patch-configure.ac
new file mode 100644
index 000000000000..f8f68a7b6d21
--- /dev/null
+++ b/security/softhsm2/patches/patch-configure.ac
@@ -0,0 +1,15 @@
+$NetBSD: patch-configure.ac,v 1.1 2019/11/06 10:11:41 he Exp $
+
+Use /var/db not /var/lib, to adhere to NetBSD hier(7).
+
+--- configure.ac.orig	2018-09-24 07:50:22.000000000 +0000
++++ configure.ac
+@@ -126,7 +126,7 @@ full_sysconfdir=`eval eval eval eval eva
+ full_localstatedir=`eval eval eval eval eval echo "${localstatedir}" | sed "s#NONE#${prefix}#" | sed "s#NONE#${ac_default_prefix}#"`
+ full_libdir=`eval eval eval eval eval echo "${libdir}" | sed "s#NONE#${prefix}#" | sed "s#NONE#${ac_default_prefix}#"`
+ default_softhsm2_conf="`eval echo ${full_sysconfdir} | sed s,NONE,$ac_default_prefix,g`/softhsm2.conf"
+-softhsmtokendir=${full_localstatedir}/lib/softhsm/tokens/
++softhsmtokendir=${full_localstatedir}/db/softhsm/tokens/
+ 
+ # Install the library in a sub-directory
+ full_libdir="$full_libdir/softhsm"
diff --git a/security/softhsm2/patches/patch-src_lib_common_Makefile.in b/security/softhsm2/patches/patch-src_lib_common_Makefile.in
new file mode 100644
index 000000000000..d928c0c9b7fb
--- /dev/null
+++ b/security/softhsm2/patches/patch-src_lib_common_Makefile.in
@@ -0,0 +1,30 @@
+$NetBSD: patch-src_lib_common_Makefile.in,v 1.1 2019/11/06 10:11:41 he Exp $
+
+Install config in example directory.
+
+--- src/lib/common/Makefile.in.orig	2016-12-05 10:05:20.000000000 +0000
++++ src/lib/common/Makefile.in
+@@ -268,6 +268,7 @@ DUMPBIN = @DUMPBIN@
+ ECHO_C = @ECHO_C@
+ ECHO_N = @ECHO_N@
+ ECHO_T = @ECHO_T@
++EGDIR = @EGDIR@
+ EGREP = @EGREP@
+ EXEEXT = @EXEEXT@
+ FGREP = @FGREP@
+@@ -768,11 +769,10 @@ uninstall-man: uninstall-man5
+ 
+ 
+ install-data-hook:
+-	test -d ${DESTDIR}${sysconfdir} || \
+-		${INSTALL} -d ${DESTDIR}${sysconfdir}
+-	test -f ${DESTDIR}${sysconfdir}/softhsm2.conf || \
+-		${INSTALL_DATA} ${top_builddir}/src/lib/common/softhsm2.conf ${DESTDIR}${sysconfdir}
+-	${INSTALL_DATA} ${top_builddir}/src/lib/common/softhsm2.conf ${DESTDIR}${sysconfdir}/softhsm2.conf.sample
++	test -d ${DESTDIR}${EGDIR} || \
++		${INSTALL} -d ${DESTDIR}${EGDIR}
++	test -f ${DESTDIR}${EGDIR}/softhsm2.conf || \
++		${INSTALL_DATA} ${top_builddir}/src/lib/common/softhsm2.conf ${DESTDIR}${EGDIR}
+ 	test -d ${DESTDIR}${softhsmtokendir} || \
+ 		${INSTALL} -d -m 1777 ${DESTDIR}${softhsmtokendir}
+