# PKCS11 with OpenSSL 3.0

**URL:** <https://hub.mender.io/t/pkcs11-with-openssl-3-0/7026>\
**Category:** General Discussions\
**Created:** [July 18, 2024, 11:34am UTC](https://hub.mender.io/t/pkcs11-with-openssl-3-0/7026 "2024-07-18T11:34:26Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![leo](https://avatars.discourse-cdn.com/v4/letter/l/c2a13f/32.png) [@leo](https://hub.mender.io/u/leo)\
**Post date:** [July 22, 2024, 10:42am UTC](https://hub.mender.io/t/pkcs11-with-openssl-3-0/7026/4 "2024-07-22T10:42:14Z")

</div>

For future reference - because it took me a while to figure this all out. I’m using Yocto Kirkstone 4.0.19 which has openssl 3.0.13. On top of that I’m using mender 4.0.2, the tpm2-pkcs11 0.19 recipe from Wind-River meta-secure-core and the pkcs11-provider 0.5 recipe back ported from Scarthgap.

I’ve configured OpenSSL similar to your example above

/etc/ssl/openssl.cnf

```auto
[openssl_init]
providers = provider_sect

# List of providers to load
[provider_sect]
default = default_sect
pkcs11 = pkcs11_sect 

[default_sect]
# Must be active or could break everything
activate = 1

[pkcs11_sect]
module = /usr/lib/ossl-modules/pkcs11.so
pkcs11-module-path = /usr/lib/pkcs11/libtpm2_pkcs11.so
activate = 1 

```

Using pkcs11-tool I’m creating an EC key. I run a script on startup that checks for the key and creates one if it doesn’t exist.

```auto
# First initialize the token
pkcs11-tool --module /usr/lib/pkcs11/libtpm2_pkcs11.so --init-token --label my_token --slot 1 --so-pin 0000

# And then login to the slot
pkcs11-tool --module /usr/lib/pkcs11/libtpm2_pkcs11.so --slot 1 --login --login-type so --init-pin --so-pin 0000 --pin 0000

# Then generate the key
pkcs11-tool --module /usr/lib/pkcs11/libtpm2_pkcs11.so --login --slot 1 --keypairgen --key-type EC:prime256v1 --label my_key --usage-sign --id 01 --pin 0000 --so-pin 0000

# And check OpenSSL can access it
openssl pkey -provider pkcs11 -noout -text -in pkcs11:object=my_key;type=private;pin-value=0000

```

And then configuring Mender to use it

```auto
{
"Security": {
        "AuthPrivateKey": "pkcs11:object=my_key;type=private;pin-value=0000"
    }
}

```

I actually don’t seem to need to set the OPENSSL\_CONF environment variable.

So altogether pretty straightforward once you get the right pieces in place.

---

_[View the full topic](https://hub.mender.io/t/pkcs11-with-openssl-3-0/7026)._