Welcome! Log In Create A New Profile

Advanced

Re: [PATCH] allow to use engine keyform for server private key

Dmitrii Pichulin
October 29, 2014 10:48AM
For example, the testing steps for ubuntu user "nx" with
nginx > openssl > engine_pkcs11 > softhsm:

1) -install softhsm (apt-get install softhsm);
-edit config (/etc/softhsm/softhsm.conf with: "0:/home/nx/slot0.db");
-init token (softhsm --init-token --slot 0 --label "NginxZero");

2) -install opensc (apt-get install opensc);
-generate key in token from step 1) (

pkcs11-tool --module=/usr/lib/softhsm/libsofthsm.so \
-l -k -d 0 -a nx_key_0 --key-type rsa:2048

)

3) -install engine_pkcs11 (apt-get install libengine-pkcs11-openssl)

4) -install openssl (apt-get install openssl libssl-dev)
-edit config (

/etc/ssl/openssl.cnf insert after "oid_section = new_oids":

openssl_conf = openssl_def
[openssl_def]
engines = engine_section
[engine_section]
pkcs11 = pkcs11_section
[pkcs11_section]
engine_id = pkcs11
dynamic_path = /usr/lib/engines/engine_pkcs11.so
MODULE_PATH = /usr/lib/softhsm/libsofthsm.so
init = 0

)
-make self-signed certificate (

openssl req -engine pkcs11 -new -key id_00 -keyform engine \
-out req.pem -text -x509 -subj "/CN=NginxZero"

openssl x509 -engine pkcs11 -signkey slot_0-id_00 \
-keyform engine -in req.pem -out cert.pem

)

5) -build nginx with this patch and with-http_ssl_module
-edit config (

nginx.conf section main:

ssl_engine pkcs11;

nginx.conf section http:

server {
listen *:443;
server_name localhost;

ssl on;
ssl_certificate /home/nx/cert.pem;
ssl_certificate_key engine:pkcs11:slot_0-id_00;

ssl_protocols SSLv2 SSLv3 TLSv1;
ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
ssl_prefer_server_ciphers on;

charset UTF-8;

location / {
root /home/nx/www;
index index.html index.htm;
}
}

)

6) run/test nginx

On 12.08.2014 4:43, Maxim Dounin wrote:
> Hello!
>
> On Mon, Aug 11, 2014 at 08:36:12AM +0400, Dmitrii Pichulin wrote:
>
>> What is the current statusof this patch?
>>
>> Let us know if it has any issues.
>
> As far as I see, there are no serious problems left. There are
> various minor style issues though (like incorrect patch subject,
> use of "char" instead of "u_char", and so on). I'm going to
> cleanup these as time permits. Please ping again if it won't
> happen in a week or two.
>
> (Meanwhile, you may try to clean things yourself and post an
> updated patch.)
>
> BTW, if you have a good example of an engine to test with, this
> may be also helpful.
>

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel
Subject Author Views Posted

[PATCH] allow to use engine keyform for server private key

Dmitrii Pichulin 2158 July 22, 2014 07:16AM

Re: [PATCH] allow to use engine keyform for server private key

Maxim Dounin 845 July 22, 2014 10:54AM

[PATCH] allow to use engine keyform for server private key

Dmitrii Pichulin 594 July 23, 2014 10:56AM

Re: [PATCH] allow to use engine keyform for server private key

Maxim Dounin 524 July 27, 2014 10:44PM

[PATCH 0 of 1 ] Questions about ENGINE_load_private_key

Dmitrii Pichulin 720 July 29, 2014 11:12AM

[PATCH 1 of 1] allow to use engine keyform for server private key

Dmitrii Pichulin 566 July 29, 2014 11:12AM

Re: [PATCH 1 of 1] allow to use engine keyform for server private key

Maxim Dounin 482 July 29, 2014 11:42AM

[PATCH] allow to use engine keyform for server private key

Dmitrii Pichulin 554 July 30, 2014 11:30AM

Re: [PATCH] allow to use engine keyform for server private key

Maxim Dounin 663 July 31, 2014 09:50AM

Re: [PATCH] allow to use engine keyform for server private key

Dmitrii Pichulin 425 August 01, 2014 01:22AM

Re: [PATCH] allow to use engine keyform for server private key

Maxim Dounin 621 August 01, 2014 01:00PM

[PATCH] allow to use engine keyform for server private key

Dmitrii Pichulin 695 August 04, 2014 03:08AM

Re: [PATCH] allow to use engine keyform for server private key

Dmitrii Pichulin 531 August 11, 2014 12:38AM

Re: [PATCH] allow to use engine keyform for server private key

Maxim Dounin 548 August 11, 2014 08:44PM

Re: [PATCH] allow to use engine keyform for server private key

Dmitrii Pichulin 3437 October 29, 2014 10:48AM

Re: [PATCH] allow to use engine keyform for server private key

Dmitrii Pichulin 489 November 21, 2014 12:22AM

Re: [PATCH] allow to use engine keyform for server private key

Maxim Dounin 693 November 21, 2014 08:10AM

Re: [PATCH] allow to use engine keyform for server private key

Maxim Dounin 674 December 03, 2014 04:26PM

Re: [PATCH] allow to use engine keyform for server private key

Dmitrii Pichulin 481 December 04, 2014 05:58AM

Re: [PATCH] allow to use engine keyform for server private key

Maxim Dounin 824 December 04, 2014 09:42AM

Re: [PATCH 0 of 1 ] Questions about ENGINE_load_private_key

Maxim Dounin 854 July 29, 2014 11:34AM



Sorry, you do not have permission to post/reply in this forum.

Online Users

Guests: 62
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready