Welcome! Log In Create A New Profile

Advanced

[PATCH] Add PKCS#11 support to nginx http module

Thomas Calderon
November 03, 2014 11:52AM
Hi,

This patch leverages PKCS#11 support in nginx http module using libp11.
This allows the private key to be stored in a dedicated hardware (or
software) component.

The following patch does not deal with the "configure" tools of nginx.
I wanted to get feedback prior to writing nginx "autoconf" scripts to
deal with multiple platforms.

To test, apply the patch, run configure (with http/ssl enabled), and
modify objs/Makefile to add "-lp11" to link the libp11 library.

To configure use the following parameters:
* ssl_pkcs11, on or off
* ssl_certificate, no change the server certificate is fetched on the disk
* ssl_certificate_key, string mapped to the PKCS#11 "label" attribute
* ssl_pkcs11_pin, string of the token PIN
* ssl_pkcs11_module, path to the PKCS#11 shared library

Instead of tweaking ngx_ssl_certificate function, I have added
the ngx_ssl_certificate_pkcs11 function which is used when ssl_pkcs11 is
enabled.

This approach could also be applied to the nginx mail module.

Feedback appreciated.

Regards,


--
Cordialement,

Thomas Calderon
Laboratoire architectures matérielles et logicielles
Sous-direction expertise
ANSSI
Tél: 01 71 75 88 55
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel
Subject Author Views Posted

[PATCH] Add PKCS#11 support to nginx http module

Thomas Calderon 1976 November 03, 2014 11:52AM

Re: [PATCH] Add PKCS#11 support to nginx http module

Piotr Sikora 461 November 03, 2014 04:52PM

Re: [PATCH] Add PKCS#11 support to nginx http module

Thomas Calderon 369 November 03, 2014 05:32PM

Re: [PATCH] Add PKCS#11 support to nginx http module

Thomas Calderon 394 November 10, 2014 09:56AM

Re: [PATCH] Add PKCS#11 support to nginx http module

Maxim Dounin 295 November 10, 2014 10:12AM

Re: [PATCH] Add PKCS#11 support to nginx http module

Thomas Calderon 364 November 10, 2014 10:38AM

Re: [PATCH] Add PKCS#11 support to nginx http module

Dmitrii Pichulin 334 November 10, 2014 10:50AM

Re: [PATCH] Add PKCS#11 support to nginx http module

Thomas Calderon 362 November 10, 2014 10:58AM

Re: [PATCH] Add PKCS#11 support to nginx http module

Dmitrii Pichulin 473 November 11, 2014 05:08AM



Sorry, you do not have permission to post/reply in this forum.

Online Users

Guests: 60
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready