This chapter describes how to verify the integration between OpenSSL 3.5 and the Utimaco u.trust GP HSM with Quantum Protect. The procedures help confirm that OpenSSL can access the HSM through the PKCS#11 provider and perform supported cryptographic operations using HSM-protected keys. Use the results to validate the configuration and investigate any issues before deploying the integration in an operational environment.
PKCS#11 Logs
Enabling PKCS#11 logging to facilitate easier testing and troubleshooting is recommended. This can be done by configuring the Logging Loglevel and LogPath parameters in the configuration file.
-
LogPath should point to a writable directory (not a specific file) where log files can be stored.
-
Logging Loglevel controls the verbosity of the logs:
-
Set it to 1 for basic logging.
-
For detailed testing and debugging, increase the level to 4.
-
The generated log file will be named cs_pkcs11_R3.log and located in the directory specified by LogPath. Reviewing this log file can help identify and resolve issues that arise during testing.
Once testing is complete, it is advisable to reduce the Logging Loglevel to 1 or 2 to limit logging to only critical or important messages, thereby optimizing performance and reducing unnecessary log data.