<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>I am currently exporing the ENGINE capabilities. The examples are quite clear about how to link OpenSSL with methods that are available in a hardware module:<br/>
- implement RSA_METHOD in MyEngine, e.g. rsaSign() wich calls rsaSign_HW()<br/>
- ENGINE_register_RSA(MyEngine)<br/>
--> OpenSSL will then automatically call that method when rsa signing is required.</div>
<div> </div>
<div>So far, so good.</div>
<div> </div>
<div>The gap in my understanding is how to access the private key. Assumimg that my hardware module contains a list of private keys, which cannot and shall not be exported, they will be referenced by some opaque reference or id, e.g "KEY_1"</div>
<div> </div>
<div>rsaSign_HW(dataToSign,"KEY_1")</div>
<div> </div>
<div>Now I need some way to configure SSL_CTX with "KEY_1" instead of the "real" key.</div>
<div>I'm thinking of some pseudo-code in the way:</div>
<div> </div>
<div>SSL_CTX_use_certificate(ctx, cert) // certificate from PEM file as usual<br/>
SSL_CTX_use_PrivateKeyReferenceForEngine(ctx, "KEY_1") </div>
<div> </div>
<div>Also there is a engine interface that looks promising, as takes some arbitrary keyId as parameter....</div>
<div> </div>
<div>privKey = ENGINE_load_private_key(MyEngine, "KEY_1")</div>
<div> </div>
<div>.. but as far as I understand, it returns the "real" key, which is not exportable.</div>
<div><br/>
Am I completety on the wrong track? What is the recommended technique?</div>
<div>Thanks for any suggestion<br/>
</div>
<div>Fabrizio</div></div></body></html>