OpenSSL 3.x/4.x (Provider)
Recall from the overview that OpenSSL has two plugin mechanisms: engines and providers. "Engines" were the plugin mechanism in OpenSSL 1.x. OpenSSL 3.x introduced "providers" and deprecated engines. OpenSSL 4.x has removed engines.
This section describes how to set up OpenSSL with a provider-based integration.
This teaches OpenSSL how to talk to a Securosys HSM over the PKCS#11 API,
using an intermediate pkcs11-provider that translates between the OpenSSL API and the PKCS#11 API.
This guide only works with OpenSSL 3.x and later. When running OpenSSL 1.x you need to use the Engine API instead.
Architecture
To connect OpenSSL (libssl.so) to Primus HSM, two components are necessary:
- Primus PKCS#11 Provider: Communicates with Primus HSM over the network, using a high performance, proprietary protocol. Exposes the standardized PKCS#11 interface.
- OpenSSL pkcs11-provider: Bridges the gap between the PKCS#11 standard and OpenSSL. Communicates with OpenSSL (libssl.so) using OpenSSL's "provider" interface.
Think of this as OpenSSL and Primus "meeting in the middle" using the PKCS#11 standard. This standard allows both providers to communicate. Each product (OpenSSL, Primus) has its own provider that implements this standard and that handles the respective custom protocol for communicating back to the product.
