Skip to main content
This section describes how to install and configure pkcs11-provider from Latchset for the OpenSSL library. The following list provides an overview of pkcs11-provider library:
LibraryDescription
pkcs11-providerAn OpenSSL 3.x cryptographic provider that enables access to cryptographic tokens—such as smart cards and Hardware Security Modules (HSMs)—through the standard PKCS#11 API. It acts as a bridge between OpenSSL’s provider-based architecture and any PKCS#11-compliant module.

​
Install pkcs11-provider

Instructions for installing pkcs11-provider depend on the Linux version being used. Perform the following instructions to install pkcs11-provider on the supported operating systems:

​
Ubuntu or Debian

Perform the following steps to install pkcs11-provider on Ubuntu 24.04 or Debian 13:
While aptcan install the minimum required version (v0.3) of pkcs11-provider, it’s recommended to compile it from source to ensure you’re using the latest version. This helps avoid compatibility issues and ensures access to the most recent features and bug fixes.
1
Install Prerequisites
Shell
sudo apt update
sudo apt install \
  git build-essential meson libssl-dev pkg-config \
  libnss3 libnss3-dev libnss3-tools \
  p11-kit opensc libp11-kit-dev
2
Build and change directories into a /src directory (recommended to keep source builds organized)
Shell
mkdir -p ~/src
cd ~/src
3
Clone the pkcs11-provider repository
Shell
git clone https://github.com/latchset/pkcs11-provider.git
cd pkcs11-provider
4
Build with Meson
Shell
meson setup builddir
meson compile -C builddir
5
Install the provider
Shell
sudo meson install -C builddir
When this command is finished, take note of where the pkcs11.so file was installed. The path will be needed for the openssl.cnf file later.

​
Red Hat or CentOS

In a terminal, run the following sequence of commands to install pkcs11-provider on Red Hat or CentOS:
1
Install Prerequisites
Shell
sudo dnf check-update
sudo dnf install -y \
  git \
  gcc \
  gcc-c++ \
  meson \
  ninja-build \
  pkgconfig \
  openssl-devel \
  nss-devel \
  p11-kit-devel \
  opensc
If the system does not support dnf, use yuminstead.
2
Change into a /usr/local/src directory (recommended to keep source builds organized)
Shell
cd /usr/local/src
3
Clone the Repository
Shell
git clone https://github.com/latchset/pkcs11-provider.git
cd pkcs11-provider
4
Build with Meson
Shell
meson setup builddir
meson compile -C builddir
5
Install the provider
Shell
sudo meson install -C builddir
When this command is finished, take note of where the pkcs11.so file was installed. The path will be needed for the openssl.cnf file later.

​
Edit the OpenSSL configuration file

Perform the following steps to edit the OpenSSL configuration file for Ubuntu or Debian-based Linux distributions and Red Hat or CentOS-based distributions:
1
Run the following command to determine the location of the global OpenSSL configuration file for the logged-in user:
Shell
openssl version -d
2
Open the openssl.cnf file in a text editor with root privileges.
3
Add the following line at the top of the file, before any sections, if it is not already present:
None
openssl_conf = openssl_init
4
Add the following text, based on your operating system, at the bottom of the file after modifying the module and pkcs11-module-path:
None
[openssl_init]
providers = provider_init

[provider_init]
default = default_init
pkcs11 = pkcs11_init

[default_init]
activate = 1

[pkcs11_init]
module = /path/to/pkcs11-provider/pkcs11.so
pkcs11-module-path = /usr/local/lib/fxpkcs11/libfxpkcs11.so
activate = 1
If you need automatic logging to the token, specify the PIN by adding the following line:pkcs11-module-token-pin = file:/path/to/filewithpin.txtThe file referenced should contain just the PIN.
5
Test if OpenSSL successfully loaded the provider.
Shell
openssl list -providers
If successful, both default and pkcs11 should be listed under providers.