Quickstart for OpenSSL (Provider)

This guide provides a short summary of how to set up OpenSSL with Primus HSM using an OpenSSL provider. This guide assumes that you are using Debian/Ubuntu. Please see the full installation guide for more details.

tip

For a wizard-like experience, use the installation script instead of the manual install. The script guides you through the process of installing and configuring the Primus PKCS#11 Provider and (optionally) integrates OpenSSL via PKCS#11.

1. Install the Primus PKCS#11 Provider and fully configure it. Verify the installation:

   ppin --test

2. Install OpenSSL and its pkcs11-provider:

   sudo apt install openssl pkcs11-provider

3. Create a separate OpenSSL configuration to enable the OpenSSL pkcs11-provider. For details, see the configuration section. Copy the following to /etc/ssl/primus.cnf.

   HOME = .
   openssl_conf = openssl_init
   config_diagnostics = 1
   
   [openssl_init]
   providers = provider_sect
   
   [provider_sect]
   default = default_sect
   base = base_sect
   pkcs11 = pkcs11_section
   
   [base_sect]
   activate = 1
   
   [default_sect]
   activate = 1
   
   [pkcs11_section]
   module = /usr/lib/x86_64-linux-gnu/ossl-modules/pkcs11.so
   pkcs11-module-path = /usr/local/primus/lib/libprimusP11.so
   pkcs11-module-encode-provider-uri-to-pem = true
   pkcs11-module-load-behavior = early
   pkcs11-module-quirks = no-deinit no-operation-state
   activate = 1

4. Edit the global /etc/ssl/openssl.cnf to include the primus.cnf. Append the following line at the end:

   .include /etc/ssl/primus.cnf

5. Test that the provider is enabled:

   openssl list -providers

   Providers:
     base
       name: OpenSSL Base Provider
       version: 3.3.1
       status: active
     default
       name: OpenSSL Default Provider
       version: 3.3.1
       status: active
     pkcs11
       name: PKCS#11 Provider
       version: 3.1.4
       status: active

   And offers @ pkcs11 algorithms:

   openssl list -signature-algorithms

   { 1.2.840.113549.1.1.1, 2.5.8.1.1, RSA, rsaEncryption } @ default
   { 1.2.840.10040.4.1, 1.2.840.10040.4.3, 1.3.14.3.2.12, 1.3.14.3.2.13, 1.3.14.3.2.27, DSA, DSA-old, DSA-SHA, DSA-SHA1, DSA-SHA1-old, dsaEncryption, dsaEncryption-old, dsaWithSHA, dsaWithSHA1, dsaWithSHA1-old } @ default
   { 1.3.101.112, ED25519 } @ default
   { 1.3.101.113, ED448 } @ default
   { 1.2.156.10197.1.301, SM2 } @ default
   ECDSA @ default
   HMAC @ default
   SIPHASH @ default
   POLY1305 @ default
   CMAC @ default
   { 1.2.840.113549.1.1.1, 2.5.8.1.1, RSA, rsaEncryption } @ pkcs11
   { 1.3.101.112, ED25519 } @ pkcs11
   { 1.3.101.113, ED448 } @ pkcs11
   ECDSA @ pkcs11

   You can use the OpenSSL storeutl command to show a public key stored on your partition:

   openssl storeutl "pkcs11:token=${PARTITION_NAME};type=public;object=${KEY_LABEL}"

Next Steps

• Read the full installation guide
• Read the tutorial to learn how to use the OpenSSL CLI