Install and configure pkcs11-provider by Latchset

this section describes how to install and configure pkcs11 provider from latchset for the openssl library the following list provides an overview of pkcs11 provider library library description pkcs11 provider an openssl 3 x cryptographic provider that enables access to cryptographic tokens—such as smart cards and hardware security modules (hsms)—through the standard pkcs#11 api it acts as a bridge between openssl’s provider based architecture and any pkcs#11 compliant module install pkcs11 provider instructions for installing pkcs11 provider depend on the linux version being used perform the following instructions to install pkcs11 provider on the supported operating systems ubuntu or debian if you have the ubuntu 24 04 or debian 13 operating system, follow the instructions below ubuntu 24 04 or debian 13 perform the following steps to install pkcs11 provider if you use ubuntu 24 04 or debian 13 while apt can install the minimum required version (v0 3) of pkcs11 provider , it's recommended to compile it from source to ensure you're using the latest version this helps avoid compatibility issues and ensures access to the most recent features and bug fixes install prerequisites sudo apt update sudo apt install \\ git build essential meson libssl dev pkg config \\ libnss3 libnss3 dev libnss3 tools \\ p11 kit opensc libp11 kit dev build and change directories into a /src directory (recommended to keep source builds organized) mkdir p /src cd /src clone the pkcs11 provider repository git clone https //github com/latchset/pkcs11 provider git cd pkcs11 provider build with meson meson setup builddir meson compile c builddir install the provider sudo meson install c builddir when this command is finished, take note of where the pkcs11 so file was installed the path will be needed for the openssl cnf file later red hat or centos in a terminal, run the following sequence of commands to install pkcs11 provider on red hat or centos install prerequisites sudo dnf check update sudo dnf install y \\ git \\ gcc \\ gcc c++ \\ meson \\ ninja build \\ pkgconfig \\ openssl devel \\ nss devel \\ p11 kit devel \\ opensc if the system does not support dnf , use yum instead change into a /usr/local/src directory (recommended to keep source builds organized) cd /usr/local/src clone the repository git clone https //github com/latchset/pkcs11 provider git cd pkcs11 provider build with meson meson setup builddir meson compile c builddir install the provider sudo meson install c builddir when this command is finished, take note of where the pkcs11 so file was installed the path will be needed for the openssl cnf file later edit the openssl configuration file perform the following steps to edit the openssl configuration file for ubuntu or debian based linux distributions and red hat or centos based distributions run the following command to determine the location of the global openssl configuration file for the logged in user openssl version d open the openssl cnf file in a text editor with root privileges add the following line at the top of the file, before any sections, if it is not already present openssl conf = openssl init add the following text, based on your operating system, at the bottom of the file after modifying the module and pkcs11 module path \[openssl init] providers = provider init \[provider init] default = default init pkcs11 = pkcs11 init \[default init] activate = 1 \[pkcs11 init] module = /path/to/pkcs11 provider/pkcs11 so pkcs11 module path = /usr/local/lib/fxpkcs11/libfxpkcs11 so activate = 1 if you need automatic logging to the token, specify the pin by adding the following line pkcs11 module token pin = file /path/to/file with pin txt the file referenced should contain just the pin test if openssl successfully loaded the provider openssl list providers if successful, both default and pkcs11 should be listed under providers