Install and configure OpenSSL Provider

this section describes how to install and configure pkcs11 provider from latchset for the openssl library the following list provides an overview of pkcs11 provider library library description pkcs11 provider an openssl 3 x cryptographic provider that enables access to cryptographic tokens—such as smart cards and hardware security modules (hsms)—through the standard pkcs#11 api it acts as a bridge between openssl’s provider based architecture and any pkcs#11 compliant module install pkcs11 provider instructions for installing pkcs11 provider depend on the linux version being used perform the following instructions to install pkcs11 provider on the supported operating systems ubuntu or debian if you have the ubuntu or debian operating system, select from the following sections depending on your version ubuntu 24 04 or debian 12 or earlier perform the following steps to install pkcs11 provider if you use ubuntu 24 04 or debian 12 or earlier while apt can install the minimum required version (v0 3) of pkcs11 provider , it's recommended to compile it from source to ensure you're using the latest version this helps avoid compatibility issues and ensures access to the most recent features and bug fixes install prerequisites sudo apt update sudo apt install git build essential meson libssl dev pkg config build and change directories into a /src directory (recommended to keep source builds organized) mkdir p /src cd /src clone the pkcs11 provider repository git clone https //github com/latchset/pkcs11 provider git cd pkcs11 provider build with meson meson build ninja c build install the provider sudo ninja c build install when this command is finished, take note of where the pkcs11 so file was installed the path will be needed for the openssl cnf file later ubuntu 25 04 or debian 13 or newer perform the following steps to install pkcs11 provider if you use ubuntu 25 04 or debian 13 or later in a terminal, run the following sequence of commands to install pkcs11 provider on ubuntu 25 04 / debian 13 or later sudo apt update sudo apt y install pkcs11 provider check to see whether the new pkcs11 so file installed in the /usr/lib/x86 64 linux gnu/ossl modules directory if not, run the following command to find out where that file was installed dpkg l pkcs11 provider red hat or centos in a terminal, run the following sequence of commands to install pkcs11 provider on red hat or centos install prerequisites sudo dnf check update sudo dnf install y git gcc gcc c++ meson ninja build pkgconfig openssl devel if the system does not support dnf , use yum instead change into a /usr/local/src directory (recommended to keep source builds organized) cd /usr/local/src clone the repository git clone https //github com/latchset/pkcs11 provider git cd pkcs11 provider build with meson meson build ninja c build install the provider sudo ninja c build install when this command is finished, take note of where the pkcs11 so file was installed the path will be needed for the openssl cnf file later edit the openssl configuration file perform the following steps to edit the openssl configuration file for ubuntu or debian based linux distributions and red hat or centos based distributions run the following command to determine the location of the global openssl configuration file for the logged in user openssl version d if editing the global openssl configuration file is preferred, skip to the next step copy the openssl cnf file and move it to a preferred directory cp /path/to/openssl cnf /custom/directory/path/openssl cnf open the openssl cnf file in a text editor if editing the global openssl configuration file, open openssl cnf in a text editor with root privileges add the following line at the top of the file, before any sections, if it is not already present openssl conf = openssl init add the following text, based on your operating system, at the bottom of the file after modifying the module and pkcs11 module path \[openssl init] providers = provider init \[provider init] default = default init pkcs11 = pkcs11 init \[default init] activate = 1 \[pkcs11 init] module = /path/to/pkcs11 provider/pkcs11 so pkcs11 module path = /usr/local/lib/fxpkcs11/libfxpkcs11 so pkcs11 module load behavior = early activate = 1 if you need automatic logging to the token, specify the pin by adding the following line pkcs11 module token pin = file /path/to/file with pin txt the file referenced should contain just the pin export the environment variable if not editing the global openssl configuration file export openssl conf=/path/to/openssl cnf test if openssl successfully loaded the provider openssl list providers if successful, both default and pkcs11 should be listed under providers for nginx, you must also add the following code to your openssl configuration file, setting the ip 1 define to your nginx server ip address \[ v3 leaf ] subjectkeyidentifier=hash authoritykeyidentifier=keyid\ always,issuer basicconstraints = critical,ca\ false keyusage = digitalsignature, keyencipherment, dataencipherment, keyagreement, nonrepudiation extendedkeyusage = serverauth, clientauth subjectaltname = @alt names \[alt names] dns 1 = subjectaltname ip 1 = nginx server ip