OpenSSL 1.x/3.x (Engine)
Recall from the overview that OpenSSL has two plugin mechanisms: engines and providers. "Engines" were the plugin mechanism in OpenSSL 1.x. OpenSSL 3.x introduced "providers" and deprecated engines. OpenSSL 4.x has removed engines.
This section describes how to set up OpenSSL with an engine-based integration for PKCS#11. This works with OpenSSL 1.x and 3.x, but not 4.x.
When running OpenSSL 3.x (or later) we recommend using the provider-based integration since engines are deprecated.
OpenSSL 1.x is end-of-life since September 2023. It does not receive security updates! We highly recommend to use a supported version of OpenSSL.
This section also describes how to integrate other applications that use openssl (namely Apache and nginx) with Primus HSM.
Architecture
Architecture graphic from RedHat