Configuring PKCS#11 for OpenSSL v1.x

To use the PKCS#11 Engine Plugin, you must first configure OpenSSL to recognize and load the engine. This process involves setting up OpenSSL to work with the OpenSC PKCS#11 module through the PKCS#11 Engine Plugin, allowing OpenSSL to communicate effectively with your Primus HSM or CloudHSM instance via the PKCS#11 interface. To do this, locate your global OpenSSL configuration file and open it in your preferred text editor.

On Windows, the config file is typically found at C:\Program Files\Common Files\SSL.

Add the following line at the beginning of the file:

openssl_conf = openssl_init

…

Then add the following lines at the end of the file:

…

[openssl_init]
engines = engine_section

[engine_section]
pkcs11 = pkcs11_section

[pkcs11_section]
engine_id = pkcs11
dynamic_path = "C:\\Users\\<Username>\\source\\repos\\libp11\\src\\pkcs11.dll"
MODULE_PATH = "C:\\Program Files\\Securosys\\Primus P11\\primusP11.dll"
PIN = <PKCS11 PIN>
init = 0 

Parameter	Description
engine_id	An arbitrary identifier for OpenSSL applications to select the engine by the identifier.
dynamic_path	The path to the PKCS#11 Engine Plugin. Replace dynamic_path with the path to the OpenSC PKCS#11 Engine Plugin from the Installation section. - On Windows, this will be the designated folder on your PC that you selected upon installation, e.g. C:\Users\<Username>\source\repos\libp11\src\pkcs11.dll.
MODULE_PATH	The path to the Primus PKCS#11 Provider. Replace MODULE_PATH with the path to the PKCS#11 provider module file. - On Windows, this is typically: C:\Program Files\Securosys\Primus P11\primusP11.dll
<PIN>	The PKCS#11 pin code of your token. Replace <PIN> with the PKCS#11 PIN of your HSM partition.

Testing the engine operation

To verify that the PKCS#11 engine is operating correctly, you can run the following OpenSSL command:

openssl engine pkcs11 -t

If the engine is functioning as expected, OpenSSL will output the following message:

(pkcs11) pkcs11 engine
     [ available ]