Install and configure pkcs11-provider by Latchset

Guide to install and configure pkcs11-provider for OpenSSL, targeting developers.

This section describes how to install and configure pkcs11-provider from Latchset for the OpenSSL library. The following list provides an overview of pkcs11-provider library:

Library	Description
pkcs11-provider	An OpenSSL 3.x cryptographic provider that enables access to cryptographic tokens—such as smart cards and Hardware Security Modules (HSMs)—through the standard PKCS#11 API. It acts as a bridge between OpenSSL’s provider-based architecture and any PKCS#11-compliant module.

Install pkcs11-provider

Instructions for installing pkcs11-provider depend on the Linux version being used. Perform the following instructions to install pkcs11-provider on the supported operating systems:

Ubuntu or Debian

Perform the following steps to install pkcs11-provider on Ubuntu 24.04 or Debian 13:

While apt can install the minimum required version (v0.3) of pkcs11-provider, Futurex recommends compiling it from source so that you use the latest version. This avoids compatibility issues and gives you access to the most recent features and bug fixes.

Install Prerequisites

Shell

sudo apt update
sudo apt install \
  git build-essential meson libssl-dev pkg-config \
  libnss3 libnss3-dev libnss3-tools \
  p11-kit opensc libp11-kit-dev

Build and change directories into a /src directory (recommended to keep source builds organized)

Shell

mkdir -p ~/src
cd ~/src

Clone the pkcs11-provider repository

Shell

git clone https://github.com/latchset/pkcs11-provider.git
cd pkcs11-provider

Build with Meson

Shell

meson setup builddir
meson compile -C builddir

Install the provider

Shell

sudo meson install -C builddir

When this command is finished, take note of where the pkcs11.so file was installed. The path will be needed for the openssl.cnf file later.

Red Hat or CentOS

In a terminal, run the following sequence of commands to install pkcs11-provider on Red Hat or CentOS:

Install Prerequisites

Shell

sudo dnf check-update
sudo dnf install -y \
  git \
  gcc \
  gcc-c++ \
  meson \
  ninja-build \
  pkgconfig \
  openssl-devel \
  nss-devel \
  p11-kit-devel \
  opensc

If the system does not support dnf, use yum instead.

Change into a /usr/local/src directory (recommended to keep source builds organized)

Shell

cd /usr/local/src

Clone the Repository

Shell

git clone https://github.com/latchset/pkcs11-provider.git
cd pkcs11-provider

Build with Meson

Shell

meson setup builddir
meson compile -C builddir

Install the provider

Shell

sudo meson install -C builddir

When this command is finished, take note of where the pkcs11.so file was installed. The path will be needed for the openssl.cnf file later.

Edit the OpenSSL configuration file

Perform the following steps to edit the OpenSSL configuration file for Ubuntu or Debian-based Linux distributions and Red Hat or CentOS-based distributions:

Run the following command to determine the location of the global OpenSSL configuration file for the logged-in user:

Shell

openssl version -d

Open the openssl.cnf file in a text editor with root privileges.

Add the following line at the top of the file, before any sections, if it is not already present:

None

openssl_conf = openssl_init

Add the following text, based on your operating system, at the bottom of the file after modifying the module and pkcs11-module-path:

None

[openssl_init]
providers = provider_sect

[provider_sect]
default = default_sect
pkcs11 = pkcs11_sect

[default_sect]
activate = 1

[pkcs11_sect]
module = /path/to/pkcs11-provider/pkcs11.so
pkcs11-module-path = /usr/local/lib/fxpkcs11/libfxpkcs11.so
activate = 1

If you need automatic logging to the token, specify the PIN by adding the following line:pkcs11-module-token-pin = file:/path/to/filewithpin.txtThe file referenced should contain just the PIN.

Test if OpenSSL successfully loaded the provider.

Shell

openssl list -providers

If successful, both default and pkcs11 should be listed under providers.