Installing the OpenSSL Provider

This section describes how to install the OpenSSL pkcs11-provider.

You can choose between installing distribution-provided packages (recommended), building yourself, and Securosys-provided packages.

Distribution-provided packages

Modern distributions offer pre-built packages for pkcs11-provider.

On Debian 13 (Trixie) or Ubuntu 24.04:

sudo apt install pkcs11-provider

On Fedora:

sudo dnf install pkcs11-provider

Build from source

If your distribution does not provide a pre-built package, you need to compile from source. Follow the upstream instructions for how to compile the library.

Securosys-provided packages

Securosys provides a pre-compiled pkcs11-provider. Warning: This package is for convenience and easy testing. If possible, use your distribution's package or compile from source.

1. Download the package.

2. Extract the files and move them to a suitable directory. This example uses /usr/local/lib/ossl-modules/. The location of the provider can then be specified in the openssl.cnf (in the next section).

   unzip /tmp/securosys/securosys_primusapi_osslv3-provider-pkcs11-executable-${P11_PROV_VERSION}.zip -d /tmp/securosys/
   sudo mkdir -p /usr/local/lib/ossl-modules
   sudo unzip -j /tmp/securosys/PrimusAPI_OSSLv3-Provider-PKCS11-${P11_PROV_VERSION}-rhel8_amd64.zip -d /usr/local/lib/ossl-modules/

3. Change the owner and permissions of the extracted files.

   sudo chown root:primus /usr/local/lib/ossl-modules/pkcs11.{so,la}
   sudo chmod 444 /usr/local/lib/ossl-modules/pkcs11.{so,la}

If you built OpenSSL yourself following the instructions in the prerequisites page, you can place the pkcs11-provider files with the built-in providers in the /opt/openssl-${OPENSSL_VERSION}/lib/ossl-modules directory.

The package with the pre-compiled binaries contains the following files:

File	Description
pkcs11.so	Dynamically-linked shared object. This file is loaded by OpenSSL
pkcs11.la	Libtool library file. Description of the library generated by libtool
pkcs11.license	Copy of the license