Welcome! Log In Create A New Profile

Advanced

Re: [PATCH] Add PKCS#11 support to nginx http module

Thomas Calderon
November 03, 2014 05:32PM
Hi Piotr,

I was not aware that some efforts were ongoing to use PKCS#11 devices with
nginx.
However, my experience with OpenSSL engine support is that the code is
dusty, rather limited and relies on external configuration files.
Dmitrii's approach requires to stack the OpenSSL engine code and OpenSC's
engine_pkcs11 which ends-up loading the real PKCS#11 middleware.
OpenSSL tends to perform multiple engine initialization which can confuse
the PKCS#11 shared library. Using the engine section in openssl.cnf ties
you up with a system-wide defined middleware.

I would rather advocate for a more direct and self-contained approach.

Regards,

Thomas Calderon.

On Mon, Nov 3, 2014 at 10:50 PM, Piotr Sikora <piotr@cloudflare.com> wrote:

> Hi Thomas,
>
> > This patch leverages PKCS#11 support in nginx http module using libp11.
> > This allows the private key to be stored in a dedicated hardware (or
> > software) component.
>
> Dmitrii Pichulin is already working on (IMHO) much better way to
> handle PKCS#11 via OpenSSL engines:
> http://mailman.nginx.org/pipermail/nginx-devel/2014-August/005740.html
>
> Best regards,
> Piotr Sikora
>
> _______________________________________________
> nginx-devel mailing list
> nginx-devel@nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx-devel
>
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel
Subject Author Views Posted

[PATCH] Add PKCS#11 support to nginx http module

Thomas Calderon 1989 November 03, 2014 11:52AM

Re: [PATCH] Add PKCS#11 support to nginx http module

Piotr Sikora 462 November 03, 2014 04:52PM

Re: [PATCH] Add PKCS#11 support to nginx http module

Thomas Calderon 370 November 03, 2014 05:32PM

Re: [PATCH] Add PKCS#11 support to nginx http module

Thomas Calderon 395 November 10, 2014 09:56AM

Re: [PATCH] Add PKCS#11 support to nginx http module

Maxim Dounin 295 November 10, 2014 10:12AM

Re: [PATCH] Add PKCS#11 support to nginx http module

Thomas Calderon 366 November 10, 2014 10:38AM

Re: [PATCH] Add PKCS#11 support to nginx http module

Dmitrii Pichulin 334 November 10, 2014 10:50AM

Re: [PATCH] Add PKCS#11 support to nginx http module

Thomas Calderon 362 November 10, 2014 10:58AM

Re: [PATCH] Add PKCS#11 support to nginx http module

Dmitrii Pichulin 474 November 11, 2014 05:08AM



Sorry, you do not have permission to post/reply in this forum.

Online Users

Guests: 75
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready