Geek asks and answers

PKCS # 11 engine not working in openssl on centos 6

I want to add the PKCS # 11 engine to OpenSSL, and I am using CentOS 6.2. I really load the engine without any problems, as you can see below:

[root@localhost 05:06:18  openssl-1.0.1e]$ openssl engine -t dynamic -pre SO_PATH:/usr/lib/openssl/engines/engine_pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/local/lib/libsst.so
(dynamic) Dynamic engine loading support
[Success]: SO_PATH:/usr/lib/openssl/engines/engine_pkcs11.so
[Success]: ID:pkcs11
[Success]: LIST_ADD:1
[Success]: LOAD
[Success]: MODULE_PATH:/usr/local/lib/libsst.so
Loaded: (pkcs11) pkcs11 engine
    [ available ]

but when I use the OpenSSL option to view the loaded engine, the pkcs11 mechanism is not listed:

[root@localhost 05:19:58  openssl-1.0.1e]$ openssl engine -v -t 
(aesni) Intel AES-NI engine (no-aesni)
     [ available ]
(dynamic) Dynamic engine loading support
     [ unavailable ]
     SO_PATH, NO_VCHECK, ID, LIST_ADD, DIR_LOAD, DIR_ADD, LOAD

and when I want to use the engine, I see this error:

[root@localhost 05:20:04  openssl-1.0.1e]$ openssl genrsa -engine pkcs11 -out priv.key 1024
invalid engine "pkcs11"
3078776556:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:185:filename(/usr/lib/openssl/engines/libpkcs11.so):   /usr/lib/openssl/engines/libpkcs11.so: cannot open shared object file: No such file or   directory
3078776556:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244:
3078776556:error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:450:
3078776556:error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:417:id=pkcs11
3078776556:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:185:filename(libpkcs11.so): libpkcs11.so: cannot open shared object file: No such file or directory
3078776556:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244:
3078776556:error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:450:
Generating RSA private key, 1024 bit long modulus
.......++++++
.......++++++
e is 65537 (0x10001)

I can’t understand what the problem is ...

+5
source share
2 answers

This problem is related to the fact that OpenSSL loads the library only once, and after that it does not save the state, therefore, if we want to save the state, we must use the following commands:

[root@localhost 04:58:25  home]$ openssl
OpenSSL> engine -t dynamic -pre SO_PATH:/usr/lib/openssl/engines/engine_pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/local/lib/libsst.so
 (dynamic) Dynamic engine loading support
 [Success]: SO_PATH:/usr/lib/openssl/engines/engine_pkcs11.so
 [Success]: ID:pkcs11
 [Success]: LIST_ADD:1
 [Success]: LOAD
 [Success]: MODULE_PATH:/usr/local/lib/libsst.so
 Loaded: (pkcs11) pkcs11 engine
      [ available ]
OpenSSL> engine
 (aesni) Intel AES-NI engine (no-aesni)
 (dynamic) Dynamic engine loading support
 (pkcs11) pkcs11 engine
OpenSSL>
+6
source

, , OpenSSL.

openssl_conf  = openssl_def

( '[' ) , [openssl_def], :

[openssl_def]
engines = engine_section

[engine_section]
pkcs11 = pkcs11_section

[pkcs11_section] 
engine_id = pkcs11
dynamic_path = /usr/lib/openssl/engines/engine_pkcs11.so
MODULE_PATH = /usr/local/lib/libsst.so
init = 0
# adapt as desired:  PIN = 1234
0

More articles:


All Articles