Installing and Configuring OpenSSL | Utimaco Integration Guides

The following section outlines the procedures required to configure OpenSSL.

For this integration two different elements regarding PKCS#11 will be used.

pkcs11-provider (pkcs11.so): A OpenSSL provider that allow OpenSSL to use pkcs#11 modules.
Utimaco PKCS#11 module (libcs_pkcs11_R3.so): This is the PKCS#11 module developed by Utimaco specifically for u.trust GP HSM.

pkcs11-provider is an open-source solution (modified specifically for this integration) while the PKCS#11 module is what the pkcs11-provider uses to connect and use the GP HSM.

Installing OpenSSL

If you use an existing or pre-installed OpenSSL software, skip the first two steps.

Install the necessary dependencies.

›_ Console

dnf -y update && \
    dnf install -y make gcc wget tar git autoconf automake libtool \
    perl-IPC-Cmd perl-core perl-Test-Harness perl-Data-Dumper \
    which findutils diffutils openssl-devel

Install OpenSSL.

›_ Console

# From the SO repository
dnf install openssl
# From the official source
cd /tmp
RUN wget https://www.openssl.org/source/openssl-3.5.0.tar.gz && \
    tar -xzvf openssl-3.5.0.tar.gz && \
    cd openssl-3.5.0 && \
    ./config --prefix=/usr/local/openssl-3.5.0 && \
    make -j$(nproc) && \
    make install && \
    cd ..

Verify the version of OpenSSL.

›_ Console

openssl version
OpenSSL 3.5.0 8 Apr 2025 (Library: OpenSSL 3.5.0 8 Apr 2025)

Installing pkcs11-provider

Install pkcs11-provider from the Utimaco source.

This version differs from the official source, as it is specifically designed to enable OpenSSL 3.5 and Quantum Protect integration.

›_ Console

cp pkcs11-provider-1.0.tar.gz /tmp/. && \
    cd /tmp && \
    tar -xzvf pkcs11-provider-1.0.tar.gz && \
    cd pkcs11-provider-1.0 && \
    PKG_CONFIG_PATH=/usr/local/openssl-3.5.0/lib64/pkgconfig meson setup builddir && \
    meson compile -C builddir && \
    meson install -C builddir && \
    cd .. && rm -rf pkcs11-provider-1.0*

Adjust the environment variables.

›_ Console

export PATH="/usr/local/openssl-3.5.0/bin:${PATH}"
export LD_LIBRARY_PATH="/usr/local/openssl-3.5.0/lib64:${LD_LIBRARY_PATH}"

The last commands should be added to /.bashrc to ensure these environmental variables are set after a reboot.