Control: tags -1 patch
Please find attached a patch that is upstreamable plus the necessary
Debian package changes to include it and make the package build with the
pkcs11-provider package.
I do not know how to contact NXP to forward it, so please do so if you
have the means.
The thing should work with the current sid and experimental openssl
versions. Please note that I have hit #1135799 for the SoftHSM2 tests
and have uploaded a NMU to DELAYED/5.
>From 86171327c1603d80efed7ccd1b808f1c3a13e594 Mon Sep 17 00:00:00 2001
From: pq <pq@local>
Date: Sat, 10 Oct 2026 21:49:38 +0200
Subject: [PATCH] Migrate PKCS#11 backend from OpenSSL ENGINE to provider API
The OpenSSL ENGINE API is deprecated and removed in OpenSSL 4.0. Rework
the PKCS#11 backend to use the modern provider and OSSL_STORE APIs
instead.
Library changes:
- Replace engine_ctx helpers with pkcs11_ctx ones that load and unload
the "pkcs11" provider via OSSL_PROVIDER_load()/OSSL_PROVIDER_unload().
- Implement pkcs11_load_certificate() and pkcs11_load_key() on top of
OSSL_STORE_open_ex()/OSSL_STORE_load(). Add build_key_uri() to force
the "type=private" component so the private key is requested from a
URI originally describing a certificate.
- Rename engine_read_certificate/engine_gen_sig_data to their pkcs11_
counterparts and update the backend selector in cst.c.
- Drop the now unused <openssl/engine.h> includes and the static
bind_engine() fallback.
Build system:
- Remove the OPENSSL_USE_STATIC_LIBS requirement and the libpkcs11.a /
libp11 dependency, no longer needed with the provider based backend.
Scripts:
- Switch the HSM helper scripts from "-engine pkcs11 -keyform engine" to
"-provider default -provider pkcs11" with pkcs11: URIs, and export
PKCS11_PROVIDER_MODULE so the provider uses the configured module.
---
src/CMakeLists.txt | 2 -
src/lib/back_end/CMakeLists.txt | 5 -
src/lib/back_end/adapt_layer_openssl.c | 23 +--
src/lib/back_end/engine.c | 255 ++++++++++++++-----------
src/lib/back_end/engine.h | 64 +++----
src/lib/back_end/ssl_backend.h | 4 +-
src/scripts/hsm_add_key.sh | 19 +-
src/scripts/hsm_ahab_pki_tree.sh | 59 +++---
src/scripts/hsm_hab4_pki_tree.sh | 75 +++-----
src/tools/cst/cst.c | 5 +-
10 files changed, 257 insertions(+), 254 deletions(-)
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 73035c6..236cc47 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -4,7 +4,6 @@ set(CMAKE_MODULE_PATH ${PROJECT_SOURCE_DIR}/cmake)
option(CST_WITH_OPENSSL "Enable OpenSSL backend" ON)
if (CST_WITH_OPENSSL)
- set(OPENSSL_USE_STATIC_LIBS TRUE)
find_package(OpenSSL 3.0.0 REQUIRED)
if(NOT OPENSSL_FOUND)
message(FATAL "Cannot find OpenSSL, please check environment")
@@ -119,7 +118,6 @@ function(find_cst_dependency_library LIB_NAME LIB_DIR_VAR LIB_VAR INCLUDE_VAR)
endfunction()
if(CST_WITH_PKCS11)
- find_cst_dependency_library("libpkcs11.a" libp11_DIR PKCS11_LIB PKCS11_INCLUDE_DIR)
add_compile_definitions(CST_WITH_PKCS11)
endif()
diff --git a/src/lib/back_end/CMakeLists.txt b/src/lib/back_end/CMakeLists.txt
index 67d5b39..a14a783 100644
--- a/src/lib/back_end/CMakeLists.txt
+++ b/src/lib/back_end/CMakeLists.txt
@@ -8,10 +8,6 @@ set(C_SOURCES
add_cst_component(back_end ${C_SOURCES})
-if(CST_WITH_PKCS11)
- target_include_directories(back_end PRIVATE ${LIBP11_INCLUDE_DIR})
-endif()
-
if(CST_WITH_PQC)
target_include_directories(back_end PRIVATE ${OQSPROVIDER_INCLUDE_DIR})
endif()
@@ -22,6 +18,5 @@ target_link_libraries(
CST::common
$<$<BOOL:${CST_WITH_PQC}>:${OQSPROVIDER_LIB}>
$<$<BOOL:${CST_WITH_PQC}>:${LIBOQS_LIB}>
- $<$<BOOL:${CST_WITH_PKCS11}>:${PKCS11_LIB}>
OpenSSL::Crypto
)
diff --git a/src/lib/back_end/adapt_layer_openssl.c b/src/lib/back_end/adapt_layer_openssl.c
index 56e06a4..04c702c 100644
--- a/src/lib/back_end/adapt_layer_openssl.c
+++ b/src/lib/back_end/adapt_layer_openssl.c
@@ -33,7 +33,6 @@
#include <openssl/rand.h>
#include <openssl/crypto.h>
#include <openssl/rsa.h>
-#include <openssl/engine.h>
#include "adapt_layer.h"
#include "ssl_backend.h"
#include "openssl_helper.h"
@@ -1336,14 +1335,14 @@ int32_t ssl_gen_sig_data(const char *in_file, const char *cert_file,
return ret;
}
-int32_t engine_gen_sig_data(const char *in_file, const char *cert_ref,
+int32_t pkcs11_gen_sig_data(const char *in_file, const char *cert_ref,
hash_alg_t hash_alg, sig_fmt_t sig_fmt,
uint8_t *sig0_buf, size_t *sig0_buf_bytes,
uint8_t *sig1_buf, size_t *sig1_buf_bytes,
func_mode_t mode)
{
- /* Engine configuration */
- struct engine_ctx *ctx = NULL;
+ /* PKCS#11 configuration */
+ struct pkcs11_ctx *ctx = NULL;
/* Certificate and private key */
X509 *cert = NULL;
EVP_PKEY *key = NULL;
@@ -1355,7 +1354,7 @@ int32_t engine_gen_sig_data(const char *in_file, const char *cert_ref,
return CAL_INVALID_ARGUMENT;
/* Allocate new context */
- ctx = engine_ctx_new();
+ ctx = pkcs11_ctx_new();
if (ctx == NULL) {
ret = CAL_CRYPTO_API_ERROR;
@@ -1363,12 +1362,12 @@ int32_t engine_gen_sig_data(const char *in_file, const char *cert_ref,
}
/* Initialize the context */
- if (!engine_ctx_init(ctx)) {
+ if (!pkcs11_ctx_init(ctx)) {
ret = CAL_CRYPTO_API_ERROR;
goto out;
}
- cert = ENGINE_load_certificate(ctx->engine, cert_ref);
+ cert = pkcs11_load_certificate(get_libctx(), cert_ref);
if (!cert) {
ret = CAL_CRYPTO_API_ERROR;
goto out;
@@ -1377,7 +1376,7 @@ int32_t engine_gen_sig_data(const char *in_file, const char *cert_ref,
X509_print_fp(stdout, cert);
#endif
- key = ENGINE_load_key(ctx->engine, cert_ref);
+ key = pkcs11_load_key(get_libctx(), cert_ref);
if (key == NULL) {
ret = CAL_CRYPTO_API_ERROR;
@@ -1422,12 +1421,10 @@ int32_t engine_gen_sig_data(const char *in_file, const char *cert_ref,
out:
if (ctx) {
/*
- * Destroy the context: ctx_finish is not called here
- * since ENGINE_finish cleanups the engine instance.
- * Calling ctx_destroy next will lead to null pointer
- * dereference.
+ * Destroy the context: the provider is unloaded and the
+ * context is freed.
*/
- engine_ctx_destroy(ctx);
+ pkcs11_ctx_destroy(ctx);
}
if (ret)
diff --git a/src/lib/back_end/engine.c b/src/lib/back_end/engine.c
index 83fa6dc..3d833ce 100644
--- a/src/lib/back_end/engine.c
+++ b/src/lib/back_end/engine.c
@@ -3,172 +3,213 @@
* Copyright 2021-2024 NXP
*/
-#define OPENSSL_SUPPRESS_DEPRECATED
-
#include "engine.h"
#include "err.h"
#include "openssl_helper.h"
-#include <openssl/engine.h>
+#include <openssl/provider.h>
+#include <openssl/store.h>
#include <openssl/err.h>
#include <openssl/x509.h>
#include <openssl/evp.h>
#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
-#if CST_WITH_PKCS11
-extern int bind_engine(ENGINE *e, const char *id, const void *fns);
-#else
-static int bind_engine(ENGINE *e, const char *id, const void *fns)
+#define PKCS11_PRIVATE_KEY_TYPE "type=private"
+
+/*
+ * build_key_uri
+ *
+ * Build a PKCS#11 URI requesting a private key from a reference that was
+ * originally meant to locate a certificate. The "type" component, if present,
+ * is replaced by "type=private". If the reference does not contain a type
+ * component, one is appended.
+ */
+static char *build_key_uri(const char *cert_ref)
{
- fprintf(stderr, "ERROR: PKCS#11 support not enabled\n");
- return 0;
+ const char *type = strstr(cert_ref, "type=");
+ const char *suffix = NULL;
+ size_t prefix_len = 0;
+ size_t suffix_len = 0;
+ char *key_ref = NULL;
+
+ if (type == NULL) {
+ key_ref = OPENSSL_malloc(strlen(cert_ref) +
+ strlen(";") +
+ strlen(PKCS11_PRIVATE_KEY_TYPE) + 1);
+ if (key_ref != NULL)
+ sprintf(key_ref, "%s;%s", cert_ref,
+ PKCS11_PRIVATE_KEY_TYPE);
+ return key_ref;
+ }
+
+ prefix_len = (size_t)(type - cert_ref);
+ suffix = strchr(type, ';');
+ if (suffix != NULL)
+ suffix_len = strlen(suffix);
+
+ key_ref = OPENSSL_malloc(prefix_len + strlen(PKCS11_PRIVATE_KEY_TYPE) +
+ suffix_len + 1);
+ if (key_ref == NULL)
+ return NULL;
+
+ memcpy(key_ref, cert_ref, prefix_len);
+ memcpy(key_ref + prefix_len, PKCS11_PRIVATE_KEY_TYPE,
+ strlen(PKCS11_PRIVATE_KEY_TYPE));
+ if (suffix != NULL)
+ memcpy(key_ref + prefix_len + strlen(PKCS11_PRIVATE_KEY_TYPE),
+ suffix, suffix_len);
+ key_ref[prefix_len + strlen(PKCS11_PRIVATE_KEY_TYPE) + suffix_len] = '\0';
+
+ return key_ref;
}
-#endif
-struct engine_ctx *engine_ctx_new(void)
+/*
+ * pkcs11_store_load
+ *
+ * Load the first object of the requested type from a PKCS#11 URI using the
+ * OSSL_STORE API.
+ */
+static void *pkcs11_store_load(OSSL_LIB_CTX *libctx, const char *uri, int type)
{
- struct engine_ctx *ctx = NULL;
+ OSSL_STORE_CTX *store = NULL;
+ OSSL_STORE_INFO *info = NULL;
+ void *object = NULL;
+
+ store = OSSL_STORE_open_ex(uri, libctx, NULL, NULL, NULL, NULL, NULL, NULL);
+ if (store == NULL) {
+ fprintf(stderr, "Error opening PKCS#11 store for %s\n", uri);
+ ERR_print_errors_fp(stderr);
+ return NULL;
+ }
+
+ while (!OSSL_STORE_eof(store)) {
+ info = OSSL_STORE_load(store);
+ if (info == NULL) {
+ /*
+ * OSSL_STORE_load() returns NULL both at end of data and
+ * on error. Stop on error, otherwise retry.
+ */
+ if (OSSL_STORE_error(store))
+ break;
+ continue;
+ }
+
+ if (OSSL_STORE_INFO_get_type(info) == type) {
+ if (type == OSSL_STORE_INFO_CERT)
+ object = OSSL_STORE_INFO_get1_CERT(info);
+ else if (type == OSSL_STORE_INFO_PKEY)
+ object = OSSL_STORE_INFO_get1_PKEY(info);
+ }
+
+ OSSL_STORE_INFO_free(info);
+
+ if (object != NULL)
+ break;
+ }
+
+ OSSL_STORE_close(store);
+
+ return object;
+}
+
+struct pkcs11_ctx *pkcs11_ctx_new(void)
+{
+ struct pkcs11_ctx *ctx = NULL;
+
+ ctx = OPENSSL_malloc(sizeof(struct pkcs11_ctx));
+ if (ctx)
+ memset(ctx, 0, sizeof(struct pkcs11_ctx));
- ctx = OPENSSL_malloc(sizeof(struct engine_ctx));
return ctx;
}
-int32_t engine_ctx_destroy(struct engine_ctx *ctx)
+int32_t pkcs11_ctx_destroy(struct pkcs11_ctx *ctx)
{
if (ctx) {
- ENGINE_free(ctx->engine);
+ if (ctx->provider)
+ OSSL_PROVIDER_unload(ctx->provider);
OPENSSL_free(ctx);
}
return 1;
}
-int32_t engine_ctx_init(struct engine_ctx *ctx)
+int32_t pkcs11_ctx_init(struct pkcs11_ctx *ctx)
{
- dynamic_fns fns;
- /* OpenSSL Initialization */
-#if OPENSSL_VERSION_NUMBER >= 0x10100000
- OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS |
- OPENSSL_INIT_ADD_ALL_DIGESTS |
- OPENSSL_INIT_LOAD_CONFIG,
- NULL);
-#else
- OPENSSL_config(NULL);
- OpenSSL_add_all_algorithms();
- OpenSSL_add_all_digests();
- ERR_load_crypto_strings();
-#endif
-
- ERR_clear_error();
-
- ENGINE_load_builtin_engines();
-
- ctx->engine = ENGINE_new();
- if (ctx->engine == NULL) {
- error("Error creating new engine instance: %s\n",
- ERR_reason_error_string(ERR_get_error()));
- return 0;
- }
-
- memset(&fns, 0, sizeof(fns));
- /* Bind the engine using the bind_engine function */
- if (!bind_engine(ctx->engine, "pkcs11", &fns)) {
- error("Error binding pkcs11 engine: %s\n",
- ERR_reason_error_string(ERR_get_error()));
- ENGINE_free(ctx->engine);
- return 0;
- }
-
-#ifdef DEBUG
- ENGINE_ctrl_cmd_string(ctx->engine, "VERBOSE", NULL, 0);
-#endif
-
- if (!ENGINE_init(ctx->engine)) {
- ENGINE_free(ctx->engine);
+#if CST_WITH_PKCS11
+ ctx->provider = OSSL_PROVIDER_load(get_libctx(), "pkcs11");
+ if (ctx->provider == NULL) {
+ fprintf(stderr, "Error loading pkcs11 provider: %s\n",
+ ERR_reason_error_string(ERR_get_error()));
return 0;
}
return 1;
+#else
+ UNUSED(ctx);
+ fprintf(stderr, "ERROR: PKCS#11 support not enabled\n");
+ return 0;
+#endif
}
-int32_t engine_ctx_finish(struct engine_ctx *ctx)
+int32_t pkcs11_ctx_finish(struct pkcs11_ctx *ctx)
{
- if (ctx)
- ENGINE_finish(ctx->engine);
+ if (ctx && ctx->provider) {
+ OSSL_PROVIDER_unload(ctx->provider);
+ ctx->provider = NULL;
+ }
return 1;
}
-X509 *ENGINE_load_certificate(ENGINE *e, const char *cert_ref)
+X509 *pkcs11_load_certificate(OSSL_LIB_CTX *libctx, const char *cert_ref)
{
- struct {
- const char *s_slot_cert_id;
- X509 *cert;
- } params = {0};
+ return pkcs11_store_load(libctx, cert_ref, OSSL_STORE_INFO_CERT);
+}
- params.s_slot_cert_id = cert_ref;
- params.cert = NULL;
+EVP_PKEY *pkcs11_load_key(OSSL_LIB_CTX *libctx, const char *key_ref)
+{
+ char *key_uri = NULL;
+ EVP_PKEY *key = NULL;
- if (!ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, ¶ms, NULL, 1)) {
- ERR_print_errors_fp(stderr);
+ key_uri = build_key_uri(key_ref);
+ if (key_uri == NULL) {
+ fprintf(stderr, "Cannot build PKCS#11 private key URI\n");
return NULL;
}
- return params.cert;
-}
+ key = pkcs11_store_load(libctx, key_uri, OSSL_STORE_INFO_PKEY);
-EVP_PKEY *ENGINE_load_key(ENGINE *e, const char *key_ref)
-{
- return ENGINE_load_private_key(e, key_ref, 0, 0);
+ OPENSSL_free(key_uri);
+
+ return key;
}
-X509 *engine_read_certificate(const char *cert_ref)
+X509 *pkcs11_read_certificate(const char *cert_ref)
{
- /* Engine configuration */
- struct engine_ctx *ctx = NULL;
+ /* PKCS#11 configuration */
+ struct pkcs11_ctx *ctx = NULL;
/* Certificate */
X509 *cert = NULL;
- /* Operation completed successfully */
- int32_t error = CAL_SUCCESS;
/* Check for valid arguments */
if (!cert_ref)
return NULL;
/* Allocate new context */
- ctx = engine_ctx_new();
+ ctx = pkcs11_ctx_new();
- if (!ctx) {
- error = CAL_CRYPTO_API_ERROR;
- goto out;
- }
+ if (!ctx)
+ return NULL;
/* Initialize the context */
- if (!engine_ctx_init(ctx)) {
- error = CAL_CRYPTO_API_ERROR;
+ if (!pkcs11_ctx_init(ctx))
goto out;
- }
-
- cert = ENGINE_load_certificate(ctx->engine, cert_ref);
- if (!cert) {
- error = CAL_CRYPTO_API_ERROR;
- goto out;
- }
-
-#ifdef DEBUG
- X509_print_fp(stdout, cert);
-#endif
+ cert = pkcs11_load_certificate(get_libctx(), cert_ref);
out:
- if (ctx) {
- /*
- * Destroy the context: ctx_finish is not called here since
- * ENGINE_finish cleanups the engine instance. Calling ctx_destroy
- * next will lead to null pointer dereference.
- */
- engine_ctx_destroy(ctx);
- }
-
- if (error)
- ERR_print_errors_fp(stderr);
+ if (ctx)
+ pkcs11_ctx_destroy(ctx);
return cert;
}
diff --git a/src/lib/back_end/engine.h b/src/lib/back_end/engine.h
index d6e1704..ee3ffb0 100644
--- a/src/lib/back_end/engine.h
+++ b/src/lib/back_end/engine.h
@@ -9,88 +9,88 @@
#include <adapt_layer.h>
#include "openssl_helper.h"
#include <openssl/evp.h>
+#include <openssl/provider.h>
#include <openssl/x509.h>
-struct engine_ctx {
- /* Engine configuration */
- ENGINE *engine;
+struct pkcs11_ctx {
+ /* PKCS#11 provider handle */
+ OSSL_PROVIDER *provider;
};
-/** engine_ctx_new
+/** pkcs11_ctx_new
*
* Allocates a new functional reference.
*
* @returns functional reference if successful NULL otherwise.
*/
-struct engine_ctx *engine_ctx_new(void);
+struct pkcs11_ctx *pkcs11_ctx_new(void);
-/** engine_ctx_destroy
+/** pkcs11_ctx_destroy
*
* Destroys context and release the functional reference from ctx_new
*
- * @param[ctx] Pointer to engine context structure
+ * @param[ctx] Pointer to pkcs11 context structure
*
* @post if successful memory space allocated for functional reference is freed.
*
- * @pre #ctx_new has been called previously.
+ * @pre #pkcs11_ctx_new has been called previously.
*
* @returns 1 if successful 0 otherwise.
*/
-int32_t engine_ctx_destroy(struct engine_ctx *ctx);
+int32_t pkcs11_ctx_destroy(struct pkcs11_ctx *ctx);
-/** engine_ctx_init
+/** pkcs11_ctx_init
*
- * Initialize context
+ * Initialize context by loading the PKCS#11 provider.
*
- * @param[ctx] Pointer to engine context structure
+ * @param[ctx] Pointer to pkcs11 context structure
*
- * @post if successful memory space allocated is freed.
- *
- * @pre #ctx_new has been called previously.
+ * @pre #pkcs11_ctx_new has been called previously.
*
* @returns 1 if successful 0 otherwise.
*/
-int32_t engine_ctx_init(struct engine_ctx *ctx);
+int32_t pkcs11_ctx_init(struct pkcs11_ctx *ctx);
-/** engine_ctx_finish
+/** pkcs11_ctx_finish
*
- * Finalize engine operations initialized with ctx_init
+ * Finalize PKCS#11 operations initialized with pkcs11_ctx_init
*
* @param[ctx] Functional reference
*
- * @pre #ctx_init has been called previously.
+ * @pre #pkcs11_ctx_init has been called previously.
*
* @returns 1 if successful 0 otherwise.
*/
-int32_t engine_ctx_finish(struct engine_ctx *ctx);
+int32_t pkcs11_ctx_finish(struct pkcs11_ctx *ctx);
-/** ENGINE_load_certificate
+/** pkcs11_load_certificate
*
- * Read certificate with a given reference from engine.
+ * Read a certificate with a given PKCS#11 URI using the OSSL_STORE API.
*
- * @param[in] e engine instance
+ * @param[in] libctx OpenSSL library context the provider was loaded into
*
- * @param[in] cert_ref certificate reference
+ * @param[in] cert_ref PKCS#11 URI of the certificate
*
- * @pre @a e, @a cert_ref must not be NULL.
+ * @pre @a libctx, @a cert_ref must not be NULL.
*
* @returns pointer to X.509 certificate if successful, NULL otherwise.
*/
-X509 *ENGINE_load_certificate(ENGINE *e, const char *cert_ref);
+X509 *pkcs11_load_certificate(OSSL_LIB_CTX *libctx, const char *cert_ref);
-/** ENGINE_load_key
+/** pkcs11_load_key
*
- * Read key with a given reference from engine.
+ * Read a private key with a given PKCS#11 URI using the OSSL_STORE API. The
+ * "type" component of the URI is adjusted so that a private key is requested.
*
- * @param[in] e engine instance
+ * @param[in] libctx OpenSSL library context the provider was loaded into
*
- * @param[in] key_ref key reference
+ * @param[in] key_ref PKCS#11 URI of the key
*
- * @pre @a e, @a key_ref must not be NULL.
+ * @pre @a libctx, @a key_ref must not be NULL.
*
* @returns pointer to EVP_PKEY key if successful, NULL otherwise.
*/
-EVP_PKEY *ENGINE_load_key(ENGINE *e, const char *key_ref);
+EVP_PKEY *pkcs11_load_key(OSSL_LIB_CTX *libctx, const char *key_ref);
#endif /* ENGINE_H */
diff --git a/src/lib/back_end/ssl_backend.h b/src/lib/back_end/ssl_backend.h
index 2577286..82293c4 100644
--- a/src/lib/back_end/ssl_backend.h
+++ b/src/lib/back_end/ssl_backend.h
@@ -14,10 +14,10 @@ int32_t ssl_gen_sig_data(const char *in_file, const char *cert_file,
X509 *ssl_read_certificate(const char *filename);
-int32_t engine_gen_sig_data(const char *in_file, const char *cert_ref,
+int32_t pkcs11_gen_sig_data(const char *in_file, const char *cert_ref,
hash_alg_t hash_alg, sig_fmt_t sig_fmt,
uint8_t *sig0_buf, size_t *sig0_buf_bytes,
uint8_t *sig1_buf, size_t *sig1_buf_bytes,
func_mode_t mode);
-X509 *engine_read_certificate(const char *cert_ref);
+X509 *pkcs11_read_certificate(const char *cert_ref);
diff --git a/src/scripts/hsm_add_key.sh b/src/scripts/hsm_add_key.sh
index 5fb010e..490bdd0 100755
--- a/src/scripts/hsm_add_key.sh
+++ b/src/scripts/hsm_add_key.sh
@@ -61,6 +61,9 @@ then
exit 1
fi
+# Have the OpenSSL pkcs11 provider use the same PKCS#11 module
+export PKCS11_PROVIDER_MODULE="$PKCS11_MODULE_PATH"
+
if [ "$interactive" = "n" ]
then
# Validate command line parameters
@@ -391,26 +394,22 @@ pkcs11-tool --module $PKCS11_MODULE_PATH -l \
--id $id
# # Generate certificate signing request
-openssl req -engine pkcs11 -new -batch \
+openssl req -provider default -provider pkcs11 -new -batch \
-subj "/CN=${key_label}/" \
- -keyform engine \
- -key "label_${key_label}" \
- -out ./${key_label}_req.pem \
- -passin pass:$USR_PIN
+ -key "pkcs11:object=${key_label};type=private;pin-value=${USR_PIN}" \
+ -out ./${key_label}_req.pem
# # Generate certificate
-openssl ca -engine pkcs11 -batch \
+openssl ca -provider default -provider pkcs11 -batch \
-md ${md} -outdir ./ \
-in ./${key_label}_req.pem \
-cert "${signing_crt}" \
- -keyform engine \
- -keyfile "label_${signing_key_label}" \
+ -keyfile "pkcs11:object=${signing_key_label};type=private;pin-value=${USR_PIN}" \
-extfile ../ca/v3_${ca}.cnf \
-out "../crts/${key_label}_crt.pem" \
-notext \
-days ${val_period} \
- -config ../ca/openssl.cnf \
- -passin pass:$USR_PIN
+ -config ../ca/openssl.cnf
# # Convert certificate to DER format
openssl x509 -outform DER \
diff --git a/src/scripts/hsm_ahab_pki_tree.sh b/src/scripts/hsm_ahab_pki_tree.sh
index b2d26d1..da2c8b5 100755
--- a/src/scripts/hsm_ahab_pki_tree.sh
+++ b/src/scripts/hsm_ahab_pki_tree.sh
@@ -104,6 +104,9 @@ then
exit 1
fi
+# Have the OpenSSL pkcs11 provider use the same PKCS#11 module
+export PKCS11_PROVIDER_MODULE="$PKCS11_MODULE_PATH"
+
if [ $interactive = "n" ]
then
# Validate command line parameters
@@ -379,16 +382,14 @@ then
--id $id
# # Generate self-signed CA certificate
- openssl req -engine pkcs11 -new -batch \
+ openssl req -provider default -provider pkcs11 -new -batch \
-${da} \
-subj ${ca_subj_req} \
- -key "label_${ca_key_label}" \
- -keyform engine \
+ -key "pkcs11:object=${ca_key_label};type=private;pin-value=${USR_PIN}" \
-out ${ca_cert}.pem \
-text -x509 -extensions v3_ca \
-days ${val_period} \
- -config ../ca/openssl.cnf \
- -passin pass:$USR_PIN
+ -config ../ca/openssl.cnf
# # Convert CA Certificate to DER format
openssl x509 -outform DER \
@@ -433,26 +434,22 @@ then
--id $id
# # Generate SRK certificate signing request
- openssl req -engine pkcs11 -new -batch \
+ openssl req -provider default -provider pkcs11 -new -batch \
-subj ${srk_subj_req} \
- -keyform engine \
- -key "label_${srk_key_label}" \
- -out temp_srk_req.pem \
- -passin pass:$USR_PIN
+ -key "pkcs11:object=${srk_key_label};type=private;pin-value=${USR_PIN}" \
+ -out temp_srk_req.pem
# # Generate SRK certificate (this is a CA cert)
- openssl ca -engine pkcs11 -batch \
+ openssl ca -provider default -provider pkcs11 -batch \
-md ${da} -outdir ./ \
-in ./temp_srk_req.pem \
-cert "${ca_cert}.pem" \
- -keyform engine \
- -keyfile "label_${ca_key_label}" \
+ -keyfile "pkcs11:object=${ca_key_label};type=private;pin-value=${USR_PIN}" \
-extfile ../ca/v3_usr.cnf \
-out "${srk_crt}.pem" \
-notext \
-days ${val_period} \
- -config ../ca/openssl.cnf \
- -passin pass:$USR_PIN
+ -config ../ca/openssl.cnf
# # Convert SRK Certificate to DER format
openssl x509 -outform DER \
@@ -508,26 +505,22 @@ do
--id $id
# # Generate SRK certificate signing request
- openssl req -engine pkcs11 -new -batch \
+ openssl req -provider default -provider pkcs11 -new -batch \
-subj ${srk_subj_req} \
- -keyform engine \
- -key "label_${srk_key_label}" \
- -out temp_srk_req.pem \
- -passin pass:$USR_PIN
+ -key "pkcs11:object=${srk_key_label};type=private;pin-value=${USR_PIN}" \
+ -out temp_srk_req.pem
# # Generate SRK certificate (this is a CA cert)
- openssl ca -engine pkcs11 -batch \
+ openssl ca -provider default -provider pkcs11 -batch \
-md ${da} -outdir ./ \
-in ./temp_srk_req.pem \
-cert "${ca_cert}.pem" \
- -keyform engine \
- -keyfile "label_${ca_key_label}" \
+ -keyfile "pkcs11:object=${ca_key_label};type=private;pin-value=${USR_PIN}" \
-extfile ../ca/v3_ca.cnf \
-out "${srk_crt}.pem" \
-notext \
-days ${val_period} \
- -config ../ca/openssl.cnf \
- -passin pass:$USR_PIN
+ -config ../ca/openssl.cnf
# # Convert SRK Certificate to DER format
openssl x509 -outform DER \
@@ -580,26 +573,22 @@ do
--id $id
# # Generate SGK certificate signing request
- openssl req -engine pkcs11 -new -batch \
+ openssl req -provider default -provider pkcs11 -new -batch \
-subj ${sgk_subj_req} \
- -keyform engine \
- -key "label_${sgk_key_label}" \
- -out temp_sgk_req.pem \
- -passin pass:$USR_PIN
+ -key "pkcs11:object=${sgk_key_label};type=private;pin-value=${USR_PIN}" \
+ -out temp_sgk_req.pem
# # Generate SGK certificate (this is a user cert)
- openssl ca -engine pkcs11 -batch \
+ openssl ca -provider default -provider pkcs11 -batch \
-md ${da} -outdir ./ \
-in ./temp_sgk_req.pem \
-cert "${srk_crt_i}.pem" \
- -keyform engine \
- -keyfile "label_${srk_key_i_label}" \
+ -keyfile "pkcs11:object=${srk_key_i_label};type=private;pin-value=${USR_PIN}" \
-extfile ../ca/v3_usr.cnf \
-out "${sgk_crt}.pem" \
-notext \
-days ${val_period} \
- -config ../ca/openssl.cnf \
- -passin pass:$USR_PIN
+ -config ../ca/openssl.cnf
# # Convert SGK Certificate to DER format
openssl x509 -outform DER \
diff --git a/src/scripts/hsm_hab4_pki_tree.sh b/src/scripts/hsm_hab4_pki_tree.sh
index f3d15aa..dc5969e 100755
--- a/src/scripts/hsm_hab4_pki_tree.sh
+++ b/src/scripts/hsm_hab4_pki_tree.sh
@@ -104,6 +104,9 @@ then
exit 1
fi
+# Have the OpenSSL pkcs11 provider use the same PKCS#11 module
+export PKCS11_PROVIDER_MODULE="$PKCS11_MODULE_PATH"
+
if [ $interactive = "n" ]
then
# Validate command line parameters
@@ -366,15 +369,13 @@ then
--id $id
# # Generate self-signed CA certificate
- openssl req -engine pkcs11 -new -batch \
+ openssl req -provider default -provider pkcs11 -new -batch \
-subj ${ca_subj_req} \
- -key "label_${ca_key_label}" \
- -keyform engine \
+ -key "pkcs11:object=${ca_key_label};type=private;pin-value=${USR_PIN}" \
-out ${ca_cert}.pem \
-text -x509 -extensions v3_ca \
-days ${val_period} \
- -config ../ca/openssl.cnf \
- -passin pass:$USR_PIN
+ -config ../ca/openssl.cnf
# # Convert CA Certificate to DER format
openssl x509 -outform DER \
@@ -419,26 +420,22 @@ then
--id $id
# # Generate SRK certificate signing request
- openssl req -engine pkcs11 -new -batch \
+ openssl req -provider default -provider pkcs11 -new -batch \
-subj ${srk_subj_req} \
- -keyform engine \
- -key "label_${srk_key_label}" \
- -out temp_srk_req.pem \
- -passin pass:$USR_PIN
+ -key "pkcs11:object=${srk_key_label};type=private;pin-value=${USR_PIN}" \
+ -out temp_srk_req.pem
# # Generate SRK certificate (this is a CA cert)
- openssl ca -engine pkcs11 -batch \
+ openssl ca -provider default -provider pkcs11 -batch \
-md sha256 -outdir ./ \
-in ./temp_srk_req.pem \
-cert "${ca_cert}.pem" \
- -keyform engine \
- -keyfile "label_${ca_key_label}" \
+ -keyfile "pkcs11:object=${ca_key_label};type=private;pin-value=${USR_PIN}" \
-extfile ../ca/v3_usr.cnf \
-out "${srk_crt}.pem" \
-notext \
-days ${val_period} \
- -config ../ca/openssl.cnf \
- -passin pass:$USR_PIN
+ -config ../ca/openssl.cnf
# # Convert SRK Certificate to DER format
openssl x509 -outform DER \
@@ -494,26 +491,22 @@ do
--id $id
# # Generate SRK certificate signing request
- openssl req -engine pkcs11 -new -batch \
+ openssl req -provider default -provider pkcs11 -new -batch \
-subj ${srk_subj_req} \
- -keyform engine \
- -key "label_${srk_key_label}" \
- -out temp_srk_req.pem \
- -passin pass:$USR_PIN
+ -key "pkcs11:object=${srk_key_label};type=private;pin-value=${USR_PIN}" \
+ -out temp_srk_req.pem
# # Generate SRK certificate (this is a CA cert)
- openssl ca -engine pkcs11 -batch \
+ openssl ca -provider default -provider pkcs11 -batch \
-md sha256 -outdir ./ \
-in ./temp_srk_req.pem \
-cert "${ca_cert}.pem" \
- -keyform engine \
- -keyfile "label_${ca_key_label}" \
+ -keyfile "pkcs11:object=${ca_key_label};type=private;pin-value=${USR_PIN}" \
-extfile ../ca/v3_ca.cnf \
-out "${srk_crt}.pem" \
-notext \
-days ${val_period} \
- -config ../ca/openssl.cnf \
- -passin pass:$USR_PIN
+ -config ../ca/openssl.cnf
# # Convert SRK Certificate to DER format
openssl x509 -outform DER \
@@ -566,26 +559,22 @@ do
--id $id
# # Generate CSF certificate signing request
- openssl req -engine pkcs11 -new -batch \
+ openssl req -provider default -provider pkcs11 -new -batch \
-subj ${csf_subj_req} \
- -keyform engine \
- -key "label_${csf_key_label}" \
- -out temp_csf_req.pem \
- -passin pass:$USR_PIN
+ -key "pkcs11:object=${csf_key_label};type=private;pin-value=${USR_PIN}" \
+ -out temp_csf_req.pem
# # Generate CSF certificate (this is a user cert)
- openssl ca -engine pkcs11 -batch \
+ openssl ca -provider default -provider pkcs11 -batch \
-md sha256 -outdir ./ \
-in ./temp_csf_req.pem \
-cert "${srk_crt_i}.pem" \
- -keyform engine \
- -keyfile "label_${srk_key_i_label}" \
+ -keyfile "pkcs11:object=${srk_key_i_label};type=private;pin-value=${USR_PIN}" \
-extfile ../ca/v3_usr.cnf \
-out "${csf_crt}.pem" \
-notext \
-days ${val_period} \
- -config ../ca/openssl.cnf \
- -passin pass:$USR_PIN
+ -config ../ca/openssl.cnf
# # Convert CSF Certificate to DER format
openssl x509 -outform DER \
@@ -632,26 +621,22 @@ do
--id $id
# # Generate IMG certificate signing request
- openssl req -engine pkcs11 -new -batch \
+ openssl req -provider default -provider pkcs11 -new -batch \
-subj ${img_subj_req} \
- -keyform engine \
- -key "label_${img_key_label}" \
- -out temp_img_req.pem \
- -passin pass:$USR_PIN
+ -key "pkcs11:object=${img_key_label};type=private;pin-value=${USR_PIN}" \
+ -out temp_img_req.pem
# # Generate IMG certificate (this is a user cert)
- openssl ca -engine pkcs11 -batch \
+ openssl ca -provider default -provider pkcs11 -batch \
-md sha256 -outdir ./ \
-in ./temp_img_req.pem \
-cert "${srk_crt_i}.pem" \
- -keyform engine \
- -keyfile "label_${srk_key_i_label}" \
+ -keyfile "pkcs11:object=${srk_key_i_label};type=private;pin-value=${USR_PIN}" \
-extfile ../ca/v3_usr.cnf \
-out "${img_crt}.pem" \
-notext \
-days ${val_period} \
- -config ../ca/openssl.cnf \
- -passin pass:$USR_PIN
+ -config ../ca/openssl.cnf
# # Convert IMG Certificate to DER format
openssl x509 -outform DER \
diff --git a/src/tools/cst/cst.c b/src/tools/cst/cst.c
index 6dde4f1..9f94053 100644
--- a/src/tools/cst/cst.c
+++ b/src/tools/cst/cst.c
@@ -38,7 +38,6 @@
#include <openssl/pem.h>
#include <openssl/conf.h>
#include <openssl/ssl.h>
-#include <openssl/engine.h>
#include "openssl_helper.h"
#include "csf.h"
#include "ssl_backend.h"
@@ -1528,8 +1527,8 @@ static int update_offsets_in_csf(uint8_t * buf, command_t * cmd_csf, uint32_t cs
static int set_backend(char *backend)
{
if ( !strcmp("pkcs11", backend) ) {
- read_certificate = engine_read_certificate;
- gen_sig_data = engine_gen_sig_data;
+ read_certificate = pkcs11_read_certificate;
+ gen_sig_data = pkcs11_gen_sig_data;
} else if ( !strcmp("ssl", backend) ) {
read_certificate = ssl_read_certificate;
gen_sig_data = ssl_gen_sig_data;
From: Bastian Germann <[email protected]>
Date: Sat, 10 Oct 2026 21:55:55 +0200
Subject: Wire up pkcs11-provider in Debian package
---
diff --git a/debian/control b/debian/control
index 3d6125c..4041f64 100644
--- a/debian/control
+++ b/debian/control
@@ -34,7 +34,7 @@ Depends:
${misc:Depends},
${shlibs:Depends}
Recommends:
- libengine-pkcs11-openssl,
+ pkcs11-provider,
p11-kit
Description: code signing tool for i.MX platform
This package provides a code signing tool for signing images
diff --git a/debian/cst.pod b/debian/cst.pod
index eed1d79..dd8a025 100644
--- a/debian/cst.pod
+++ b/debian/cst.pod
@@ -26,7 +26,7 @@ The CSF contains the authentication commands and signature data used to verify s
The tool processes a plain-text CSF description file and produces a binary CSF that can be appended to or embedded in a boot image.
Optionally, a certificate can be provided to encrypt the Data Encryption Key (DEK).
-The tool will load general settings and those related to discover PKCS#11 module from the system wide OpenSSL configuration file.
+The tool uses the OpenSSL PKCS#11 provider (pkcs11-provider) to access keys and certificates stored on a PKCS#11 token. The provider is configured through the system-wide OpenSSL configuration file or the B<PKCS11_PROVIDER_MODULE> environment variable.
=head1 OPTIONS
diff --git a/debian/patches/series b/debian/patches/series
index e921ad2..2033e35 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,9 +1,9 @@
+pkcs11-migrate-engine-to-provider.patch
unbreak-scripts.patch
fix-shell-syntax.patch
be-compat.patch
fix_scripts_shebang.patch
check_return_values.patch
-openssl_engine_dynload.patch
hidapi_libusb_dynlink.patch
libjson_c_dynlink.patch
libusb_dynlink.patch
diff --git a/debian/patches/unbreak-scripts.patch b/debian/patches/unbreak-scripts.patch
index 8d12197..c6765eb 100644
--- a/debian/patches/unbreak-scripts.patch
+++ b/debian/patches/unbreak-scripts.patch
@@ -6,14 +6,6 @@ Fall back to the installed openssl configuration directory if none is given.
Based on the original patch by Sean Anderson <[email protected]>
---
- src/scripts/add_key.sh | 56 ++++----------------------------
- src/scripts/ahab_pki_tree.sh | 68 ++++++++------------------------------
- src/scripts/hab4_pki_tree.sh | 70 ++++++++--------------------------------
- src/scripts/hsm_add_key.sh | 45 ++++----------------------
- src/scripts/hsm_ahab_pki_tree.sh | 65 +++++++------------------------------
- src/scripts/hsm_hab4_pki_tree.sh | 70 ++++++++--------------------------------
- 6 files changed, 67 insertions(+), 307 deletions(-)
-
diff --git a/src/scripts/add_key.sh b/src/scripts/add_key.sh
index 6f4d3db..77ed2a7 100755
--- a/src/scripts/add_key.sh
@@ -365,10 +357,10 @@ index be9f968..7d2378a 100755
-fi
exit 0
diff --git a/src/scripts/hsm_add_key.sh b/src/scripts/hsm_add_key.sh
-index 5fb010e..eff1844 100755
+index 490bdd0..10bce14 100755
--- a/src/scripts/hsm_add_key.sh
+++ b/src/scripts/hsm_add_key.sh
-@@ -330,47 +330,16 @@ else
+@@ -333,47 +333,16 @@ else
fi
fi
@@ -421,25 +413,25 @@ index 5fb010e..eff1844 100755
# Generate outputs
if [ $kt = "ecc" ]
-@@ -405,11 +374,11 @@ openssl ca -engine pkcs11 -batch \
+@@ -405,11 +374,11 @@ openssl ca -provider default -provider pkcs11 -batch \
+ -in ./${key_label}_req.pem \
-cert "${signing_crt}" \
- -keyform engine \
- -keyfile "label_${signing_key_label}" \
+ -keyfile "pkcs11:object=${signing_key_label};type=private;pin-value=${USR_PIN}" \
- -extfile ../ca/v3_${ca}.cnf \
+ -extfile $ca_dir/v3_${ca}.cnf \
-out "../crts/${key_label}_crt.pem" \
-notext \
-days ${val_period} \
-- -config ../ca/openssl.cnf \
-+ -config $ca_dir/openssl.cnf \
- -passin pass:$USR_PIN
+- -config ../ca/openssl.cnf
++ -config $ca_dir/openssl.cnf
# # Convert certificate to DER format
+ openssl x509 -outform DER \
diff --git a/src/scripts/hsm_ahab_pki_tree.sh b/src/scripts/hsm_ahab_pki_tree.sh
-index b2d26d1..ee740ad 100755
+index da2c8b5..1b533d9 100755
--- a/src/scripts/hsm_ahab_pki_tree.sh
+++ b/src/scripts/hsm_ahab_pki_tree.sh
-@@ -289,47 +289,16 @@ then
+@@ -292,47 +292,16 @@ then
read srk_ca
fi
@@ -492,58 +484,58 @@ index b2d26d1..ee740ad 100755
# Check that the file "serial" is present, if not create it:
if [ ! -f serial ]
-@@ -387,7 +356,7 @@ then
+@@ -389,7 +358,7 @@ then
-out ${ca_cert}.pem \
-text -x509 -extensions v3_ca \
-days ${val_period} \
-- -config ../ca/openssl.cnf \
-+ -config $ca_dir/openssl.cnf \
- -passin pass:$USR_PIN
+- -config ../ca/openssl.cnf
++ -config $ca_dir/openssl.cnf
# # Convert CA Certificate to DER format
-@@ -447,11 +416,11 @@ then
+ openssl x509 -outform DER \
+@@ -445,11 +414,11 @@ then
+ -in ./temp_srk_req.pem \
-cert "${ca_cert}.pem" \
- -keyform engine \
- -keyfile "label_${ca_key_label}" \
+ -keyfile "pkcs11:object=${ca_key_label};type=private;pin-value=${USR_PIN}" \
- -extfile ../ca/v3_usr.cnf \
+ -extfile $ca_dir/v3_usr.cnf \
-out "${srk_crt}.pem" \
-notext \
-days ${val_period} \
-- -config ../ca/openssl.cnf \
-+ -config $ca_dir/openssl.cnf \
- -passin pass:$USR_PIN
+- -config ../ca/openssl.cnf
++ -config $ca_dir/openssl.cnf
# # Convert SRK Certificate to DER format
-@@ -522,11 +491,11 @@ do
+ openssl x509 -outform DER \
+@@ -516,11 +485,11 @@ do
+ -in ./temp_srk_req.pem \
-cert "${ca_cert}.pem" \
- -keyform engine \
- -keyfile "label_${ca_key_label}" \
+ -keyfile "pkcs11:object=${ca_key_label};type=private;pin-value=${USR_PIN}" \
- -extfile ../ca/v3_ca.cnf \
+ -extfile $ca_dir/v3_ca.cnf \
-out "${srk_crt}.pem" \
-notext \
-days ${val_period} \
-- -config ../ca/openssl.cnf \
-+ -config $ca_dir/openssl.cnf \
- -passin pass:$USR_PIN
+- -config ../ca/openssl.cnf
++ -config $ca_dir/openssl.cnf
# # Convert SRK Certificate to DER format
-@@ -594,11 +563,11 @@ do
+ openssl x509 -outform DER \
+@@ -584,11 +553,11 @@ do
+ -in ./temp_sgk_req.pem \
-cert "${srk_crt_i}.pem" \
- -keyform engine \
- -keyfile "label_${srk_key_i_label}" \
+ -keyfile "pkcs11:object=${srk_key_i_label};type=private;pin-value=${USR_PIN}" \
- -extfile ../ca/v3_usr.cnf \
+ -extfile $ca_dir/v3_usr.cnf \
-out "${sgk_crt}.pem" \
-notext \
-days ${val_period} \
-- -config ../ca/openssl.cnf \
-+ -config $ca_dir/openssl.cnf \
- -passin pass:$USR_PIN
+- -config ../ca/openssl.cnf
++ -config $ca_dir/openssl.cnf
# # Convert SGK Certificate to DER format
-@@ -621,14 +590,4 @@ do
+ openssl x509 -outform DER \
+@@ -610,14 +579,4 @@ do
done
fi
@@ -559,10 +551,10 @@ index b2d26d1..ee740ad 100755
-fi
exit 0
diff --git a/src/scripts/hsm_hab4_pki_tree.sh b/src/scripts/hsm_hab4_pki_tree.sh
-index f3d15aa..d46d1b1 100755
+index dc5969e..99b14c9 100755
--- a/src/scripts/hsm_hab4_pki_tree.sh
+++ b/src/scripts/hsm_hab4_pki_tree.sh
-@@ -277,47 +277,16 @@ then
+@@ -280,47 +280,16 @@ then
read srk_ca
fi
@@ -615,72 +607,72 @@ index f3d15aa..d46d1b1 100755
# Check that the file "serial" is present, if not create it:
if [ ! -f serial ]
-@@ -373,7 +342,7 @@ then
+@@ -375,7 +344,7 @@ then
-out ${ca_cert}.pem \
-text -x509 -extensions v3_ca \
-days ${val_period} \
-- -config ../ca/openssl.cnf \
-+ -config $ca_dir/openssl.cnf \
- -passin pass:$USR_PIN
+- -config ../ca/openssl.cnf
++ -config $ca_dir/openssl.cnf
# # Convert CA Certificate to DER format
-@@ -433,11 +402,11 @@ then
+ openssl x509 -outform DER \
+@@ -431,11 +400,11 @@ then
+ -in ./temp_srk_req.pem \
-cert "${ca_cert}.pem" \
- -keyform engine \
- -keyfile "label_${ca_key_label}" \
+ -keyfile "pkcs11:object=${ca_key_label};type=private;pin-value=${USR_PIN}" \
- -extfile ../ca/v3_usr.cnf \
+ -extfile $ca_dir/v3_usr.cnf \
-out "${srk_crt}.pem" \
-notext \
-days ${val_period} \
-- -config ../ca/openssl.cnf \
-+ -config $ca_dir/openssl.cnf \
- -passin pass:$USR_PIN
+- -config ../ca/openssl.cnf
++ -config $ca_dir/openssl.cnf
# # Convert SRK Certificate to DER format
-@@ -508,11 +477,11 @@ do
+ openssl x509 -outform DER \
+@@ -502,11 +471,11 @@ do
+ -in ./temp_srk_req.pem \
-cert "${ca_cert}.pem" \
- -keyform engine \
- -keyfile "label_${ca_key_label}" \
+ -keyfile "pkcs11:object=${ca_key_label};type=private;pin-value=${USR_PIN}" \
- -extfile ../ca/v3_ca.cnf \
+ -extfile $ca_dir/v3_ca.cnf \
-out "${srk_crt}.pem" \
-notext \
-days ${val_period} \
-- -config ../ca/openssl.cnf \
-+ -config $ca_dir/openssl.cnf \
- -passin pass:$USR_PIN
+- -config ../ca/openssl.cnf
++ -config $ca_dir/openssl.cnf
# # Convert SRK Certificate to DER format
-@@ -580,11 +549,11 @@ do
+ openssl x509 -outform DER \
+@@ -570,11 +539,11 @@ do
+ -in ./temp_csf_req.pem \
-cert "${srk_crt_i}.pem" \
- -keyform engine \
- -keyfile "label_${srk_key_i_label}" \
+ -keyfile "pkcs11:object=${srk_key_i_label};type=private;pin-value=${USR_PIN}" \
- -extfile ../ca/v3_usr.cnf \
+ -extfile $ca_dir/v3_usr.cnf \
-out "${csf_crt}.pem" \
-notext \
-days ${val_period} \
-- -config ../ca/openssl.cnf \
-+ -config $ca_dir/openssl.cnf \
- -passin pass:$USR_PIN
+- -config ../ca/openssl.cnf
++ -config $ca_dir/openssl.cnf
# # Convert CSF Certificate to DER format
-@@ -646,11 +615,11 @@ do
+ openssl x509 -outform DER \
+@@ -632,11 +601,11 @@ do
+ -in ./temp_img_req.pem \
-cert "${srk_crt_i}.pem" \
- -keyform engine \
- -keyfile "label_${srk_key_i_label}" \
+ -keyfile "pkcs11:object=${srk_key_i_label};type=private;pin-value=${USR_PIN}" \
- -extfile ../ca/v3_usr.cnf \
+ -extfile $ca_dir/v3_usr.cnf \
-out "${img_crt}.pem" \
-notext \
-days ${val_period} \
-- -config ../ca/openssl.cnf \
-+ -config $ca_dir/openssl.cnf \
- -passin pass:$USR_PIN
+- -config ../ca/openssl.cnf
++ -config $ca_dir/openssl.cnf
# # Convert IMG Certificate to DER format
-@@ -672,15 +641,4 @@ do
+ openssl x509 -outform DER \
+@@ -657,15 +626,4 @@ do
i=$((i+1))
done
fi
diff --git a/debian/rules b/debian/rules
index e11586b..db9245d 100755
--- a/debian/rules
+++ b/debian/rules
@@ -11,7 +11,7 @@ DPKG_EXPORT_BUILDTOOLS = 1
include /usr/share/dpkg/architecture.mk
include /usr/share/dpkg/buildflags.mk
include /usr/share/dpkg/buildtools.mk
-CFLAGS += -std=c99 -D_POSIX_C_SOURCE=200809L -fPIC
+CFLAGS += -std=c99 -D_POSIX_C_SOURCE=200809L -fPIC -Wno-error=discarded-qualifiers
PACKAGE := $(firstword $(shell dh_listpackages))
TMP := $(CURDIR)/debian/$(PACKAGE)
diff --git a/debian/tests/control b/debian/tests/control
index 5c9d71d..03aede8 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -5,5 +5,5 @@ Tests: create-csf
Restrictions: allow-stderr
Tests: hsm-sign
-Depends: @, libengine-pkcs11-openssl, opensc, p11-kit, softhsm2, libsofthsm2, util-linux-extra
+Depends: @, pkcs11-provider, opensc, p11-kit, softhsm2, libsofthsm2, util-linux-extra
Restrictions: allow-stderr, needs-sudo
diff --git a/debian/tests/hsm-sign b/debian/tests/hsm-sign
index 724a132..7d8965a 100755
--- a/debian/tests/hsm-sign
+++ b/debian/tests/hsm-sign
@@ -30,10 +30,10 @@ softhsm2-util --init-token --slot 0 --label "$token" --pin "$pin" --so-pin "$so_
openssl ec -in "${dir}/keys/CSF1_1_sha256_secp256r1_v3_usr_key.pem" -out "${dir}/keys/CSF1_1_sha256_secp256r1_v3_usr_key.decrypted.pem" -passin pass:"$key_pass"
openssl ec -in "${dir}/keys/IMG1_1_sha256_secp256r1_v3_usr_key.pem" -out "${dir}/keys/IMG1_1_sha256_secp256r1_v3_usr_key.decrypted.pem" -passin pass:"$key_pass"
-pkcs11-tool --module $pkcs11_module -l --write-object "${dir}/keys/CSF1_1_sha256_secp256r1_v3_usr_key.decrypted.pem" --type privkey --usage-sign --label CSF_1_1 --pin "$pin"
-pkcs11-tool --module $pkcs11_module -l --write-object "${dir}/keys/IMG1_1_sha256_secp256r1_v3_usr_key.decrypted.pem" --type privkey --usage-sign --label IMG_1_1 --pin "$pin"
-pkcs11-tool --module $pkcs11_module -l --write-object "${dir}/crts/CSF1_1_sha256_secp256r1_v3_usr_crt.pem" --type cert --label CSF_1_1 --pin "$pin"
-pkcs11-tool --module $pkcs11_module -l --write-object "${dir}/crts/IMG1_1_sha256_secp256r1_v3_usr_crt.pem" --type cert --label IMG_1_1 --pin "$pin"
+pkcs11-tool --module $pkcs11_module -l --write-object "${dir}/keys/CSF1_1_sha256_secp256r1_v3_usr_key.decrypted.pem" --type privkey --usage-sign --id 01 --label CSF_1_1 --pin "$pin"
+pkcs11-tool --module $pkcs11_module -l --write-object "${dir}/keys/IMG1_1_sha256_secp256r1_v3_usr_key.decrypted.pem" --type privkey --usage-sign --id 02 --label IMG_1_1 --pin "$pin"
+pkcs11-tool --module $pkcs11_module -l --write-object "${dir}/crts/CSF1_1_sha256_secp256r1_v3_usr_crt.pem" --type cert --id 01 --label CSF_1_1 --pin "$pin"
+pkcs11-tool --module $pkcs11_module -l --write-object "${dir}/crts/IMG1_1_sha256_secp256r1_v3_usr_crt.pem" --type cert --id 02 --label IMG_1_1 --pin "$pin"
cat > hab4.csf <<EOF
[Header]
