1

I am trying to install the pkcs11 engine plugin for Openssl 1.1.0e on Raspbian Stretch. The usual package libengine-pkcs11-openssl install an engine for an earlier version of Openssl. Unsurprisingly it yields an error message about incompatible versions.

It seems it expects a library at /usr/lib/arm-linux-gnueabihf/engines-1.1/pkcs11.so. But I can't find any Raspbian package containing such a file.

Can somebody tell me what package(s) I need to install for this ? And how it translates to the Openssl config ?

0

I have the same issue on Debian Stretch (not Raspberry). Unfortunatly I dont have a solution yet. It could be a bug in the Debian repository.

Debian Stretch comes with:

OpenSSL> version
OpenSSL 1.1.0e  16 Feb 2017

However, Debian seems to supply a library for 1.0.2:

# dpkg -S pkcs11.so
opensc-pkcs11:amd64: /usr/lib/x86_64-linux-gnu/onepin-opensc-pkcs11.so
libengine-pkcs11-openssl:amd64: /usr/lib/x86_64-linux-gnu/openssl-1.0.2/engines/libpkcs11.so
opensc-pkcs11:amd64: /usr/lib/x86_64-linux-gnu/pkcs11/onepin-opensc-pkcs11.so
libengine-pkcs11-openssl:amd64: /usr/lib/x86_64-linux-gnu/openssl-1.0.2/engines/pkcs11.so
opensc-pkcs11:amd64: /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so
opensc-pkcs11:amd64: /usr/lib/x86_64-linux-gnu/pkcs11/opensc-pkcs11.so

There also seems to be a bugreport for this issue, but it looks like it will not be fixed any time soon. See Debian Bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=846548

To resolve this issue I compiled the PKCS#11 engine myself. I downloaded it from https://github.com/OpenSC/libp11/

Please note that besides the usual compilation tools (apt-get install build-essential autoconf automake) you also need package pkg-config. Otherwise the installation fails.

Using the newly compiled driver I managed to get it working:

# OPENSSL_CONF=./hsm.conf openssl engine  
(dynamic) Dynamic engine loading support
(pkcs11) pkcs11 engine

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.