Install and configure the pkcs11-provider module

Install the pkcs11-provider module from Latchset. This module allows OpenSSL 3.x to use PKCS #11 tokens through a provider interface. Follow the steps for your Linux version.

Install on Ubuntu or Debian

Install the required packages:

Shell

sudo apt update
sudo apt install \
    git build-essential meson libssl-dev pkg-config \
    libnss3 libnss3-dev libnss3-tools \
    p11-kit opensc libp11-kit-dev \
    python3-asn1crypto

Create a source directory and change into it:

Shell

mkdir -p ~/src
cd ~/src

Clone the pkcs11-provider repository:

Shell

git clone https://github.com/latchset/pkcs11-provider.git
cd pkcs11-provider

Build the provider:

Shell

meson setup builddir
meson compile -C builddir

Install the provider:

Shell

sudo meson install -C builddir

During installation, the pkcs11.so module is copied to the OpenSSL modules directory. You’ll need this path when updating the OpenSSL configuration file.

Example output:

Shell

Installing src/pkcs11.so to /usr/lib/x86_64-linux-gnu/ossl-modules

In this example, pkcs11.so is installed in /usr/lib/x86_64-linux-gnu/ossl-modules.

Install on RHEL

ImportantThis step includes enabling the EPEL and CodeReady Builder (CRB) repositories, so ensure you have a valid RHEL subscription.

Enable CodeReady Builder (CRB):RHEL 8:

Shell

sudo subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms

RHEL 9:

Shell

sudo subscription-manager repos --enable codeready-builder-for-rhel-9-$(arch)-rpms

Alma and Rocky Linux 8:

Shell

sudo dnf config-manager --set-enabled powertools

Alma and Rocky Linux 9:

Shell

sudo dnf config-manager --set-enabled crb

Install the EPEL Release package:

Shell

sudo dnf install epel-release

Refresh metadata:

Shell

sudo dnf makecache

Install prerequisites:

Shell

sudo dnf check-update
sudo dnf install -y \
    git \
    gcc \
    gcc-c++ \
    meson \
    ninja-build \
    pkgconfig \
    openssl-devel \
    nss-devel \
    p11-kit-devel \
    opensc
    python3-asn1crypto

Change to a source directory:

Shell

cd /usr/local/src

Clone the repository:

Shell

git clone https://github.com/latchset/pkcs11-provider.git
cd pkcs11-provider

Build the provider:

Shell

meson setup builddir
meson compile -C builddir

Install the provider:

Shell

sudo meson install -C builddir

During installation, the pkcs11.so module is copied to the OpenSSL modules directory. You’ll need this path when updating the OpenSSL configuration file.

Example output:

Shell

Installing src/pkcs11.so to /usr/lib64/ossl-modules

In this example, pkcs11.so is installed in /usr/lib64/ossl-modules.

Configure OpenSSL to load the provider

Locate the OpenSSL configuration file. You can verify it using the following command openssl version -d. For instance:

For Ubuntu/Debian:

Shell

root@openvpnas:~# openssl version -d
OPENSSLDIR: "/usr/lib/ssl"

For RHEL:

Shell

root@openvpnas:~# openssl version -d
OPENSSLDIR: "/etc/pki/tls"

ImportantThis tutorial assumes openssl.cnf is located in /usr/lib/ssl/. Update the path in the following commands accordingly.

Create a backup of the OpenSSL configuration file before making changes:

Shell

cp /usr/lib/ssl/openssl.cnf /usr/lib/ssl/openssl-backup.cnf

Open the OpenSSL configuration file for editing:

Shell

nano /usr/lib/ssl/openssl.cnf

At the top of the file, add the following line if it’s not already present:

Configuration

openssl_conf = openssl_init

At the bottom of the file, add the following configuration block. Update the paths as needed for your system:

Configuration

[openssl_init]
providers = provider_init

[provider_init]
default = default_init
pkcs11 = pkcs11_init

[default_init]
activate = 1

[pkcs11_init]
module = /path/to/pkcs11-provider/pkcs11.so
pkcs11-module-path = /usr/local/lib/fxpkcs11/libfxpkcs11.so
pkcs11-module-token-pin = file:/path/to/file_with_pin.txt
activate = 1

Update the paths accordingly. In our example:

Replace /path/to/pkcs11-provider/pkcs11.so with /usr/lib/x86_64-linux-gnu/ossl-modules/pkcs11.so
Replace /path/to/file_with_pin.txt with /root/pkcs11-pin.txt

If you’re not sure where pkcs11.so is on your system, run this command:find / -type f -path '*/ossl-modules/pkcs11.so' 2>/dev/null

Save and exit the file — Ctrl-X, Y, then Enter.

Verify that the PKCS #11 provider loads correctly:

Shell

openssl list -providers

You should see both default and pkcs11 listed.
Example output:

Shell

root@openvpnas:~# openssl list -providers
Providers:
  default
    name: OpenSSL Default Provider
    version: 3.0.13
    status: active
  pkcs11
    name: PKCS#11 Provider
    version: 1.1
    status: active

Reboot the Access Server host:

Shell

reboot

​Install on Ubuntu or Debian

​Install on RHEL

​Configure OpenSSL to load the provider

Install on Ubuntu or Debian

Install on RHEL

Configure OpenSSL to load the provider