diff --git a/proxmox-serde/Cargo.toml b/proxmox-serde/Cargo.toml
index 5919f21e..a5d3da28 100644
--- a/proxmox-serde/Cargo.toml
+++ b/proxmox-serde/Cargo.toml
@@ -12,6 +12,7 @@ exclude = [ "debian" ]
 anyhow = "1.0"
 base64 = "0.13"
 serde = { version = "1.0", features = ["derive"] }
+serde_json = { version = "1.0", optional = true }
 
 proxmox-time = { path = "../proxmox-time", version = "1.0.0" }
 
diff --git a/proxmox-serde/src/json.rs b/proxmox-serde/src/json.rs
new file mode 100644
index 00000000..63574d33
--- /dev/null
+++ b/proxmox-serde/src/json.rs
@@ -0,0 +1,55 @@
+use anyhow::{bail, Error};
+
+use serde_json::Value;
+
+/// Generate canonical JSON.
+///
+/// This is used (among other things) for preparing JSON documents for signing.
+pub fn to_canonical_json(value: &Value) -> Result<Vec<u8>, Error> {
+    let mut data = Vec::new();
+    write_canonical_json(value, &mut data)?;
+    Ok(data)
+}
+
+/// Write canonical JSON to `output`.
+///
+/// This is used (among other things) for preparing JSON documents for signing.
+pub fn write_canonical_json(value: &Value, output: &mut Vec<u8>) -> Result<(), Error> {
+    match value {
+        Value::Null => bail!("got unexpected null value"),
+        Value::String(_) | Value::Number(_) | Value::Bool(_) => {
+            serde_json::to_writer(output, &value)?;
+        }
+        Value::Array(list) => {
+            output.push(b'[');
+            let mut iter = list.iter();
+            if let Some(item) = iter.next() {
+                write_canonical_json(item, output)?;
+                for item in iter {
+                    output.push(b',');
+                    write_canonical_json(item, output)?;
+                }
+            }
+            output.push(b']');
+        }
+        Value::Object(map) => {
+            output.push(b'{');
+            let mut keys: Vec<&str> = map.keys().map(String::as_str).collect();
+            keys.sort_unstable();
+            let mut iter = keys.into_iter();
+            if let Some(key) = iter.next() {
+                serde_json::to_writer(&mut *output, &key)?;
+                output.push(b':');
+                write_canonical_json(&map[key], output)?;
+                for key in iter {
+                    output.push(b',');
+                    serde_json::to_writer(&mut *output, &key)?;
+                    output.push(b':');
+                    write_canonical_json(&map[key], output)?;
+                }
+            }
+            output.push(b'}');
+        }
+    }
+    Ok(())
+}
diff --git a/proxmox-serde/src/lib.rs b/proxmox-serde/src/lib.rs
index 79c7401e..e1dc16a3 100644
--- a/proxmox-serde/src/lib.rs
+++ b/proxmox-serde/src/lib.rs
@@ -3,6 +3,9 @@
 #[macro_use]
 pub mod serde_macros;
 
+#[cfg(feature = "serde_json")]
+pub mod json;
+
 /// Serialize Unix epoch (i64) as RFC3339.
 ///
 /// Usage example: