<html><head></head><body><div dir="auto">Sorry about that<br><br></div>
<div dir="auto">It is TLS and we want Root Of Trust from a non exportable, non readable Private key on the Hardware Security Module.<br><br></div>
<div dir="auto">By explicitly adding "-keyform ENG" s_client works perfectly.<br><br></div>
<div dir="auto">And with cURL "--key-type ENG" also works<br><br></div>
<div dir="auto">NodeJs crypto module has setEngine but there's no option for passing keyform.<br><br></div>
<div dir="auto">I requested from NodeJs team as well, but if we can do something to tell openssl "keyform is always ENG" I think maybe that would work.</div>
<div style="font-size:10.0pt;font-family:"Tahoma","sans-serif";padding:3.0pt 0in 0in 0in">
<hr style="border:none;border-top:solid #E1E1E1 1.0pt">
<b>From:</b> Viktor Dukhovni <openssl-users@dukhovni.org><br>
<b>Sent:</b> Sun Jun 02 18:35:37 PDT 2019<br>
<b>To:</b> openssl-users@openssl.org<br>
<b>Subject:</b> Re: -keyform ENG and NodeJS<br>
</openssl-users@dukhovni.org></div>
<br>
<pre class="blue">On Sun, Jun 02, 2019 at 05:49:10PM -0700, Erik Madsen wrote:<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> I am using a Hardware Security Module. Both s_client and cURL work fine <br> due to we can use the CLI "-keyform ENG" for s_client and "--key-type <br> ENG" for curl<br> <br> Is it possible to specify this in the openssl.cnf file instead of the CLI?<br></blockquote><br>You could be a bit more explicit about whether this a TLS or some<br>other application. Configuration is "module"-specific.<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> For testing this, the following works:<br> <br> openssl s_client -connect host:port -engine engineSO -keyform ENG -cert <br> /path/to/signed/cert<br> <br> <br> If we can do like this:<br> <br> OPENSSL_CONF=openssl.cnf openssl s_client -connect host:port -engine <br> engineSO -cert /path/to/signed/cert (removed the -keyform)<br> <br> I think will work fine<br></blockquote><br>I don't believe that the SSL "conf module" presently supports a<br>"command" that allows you specify the "keyform" of a private key<br>file. It has a "PrivateKey" "command", but this appears to be<br>unconditionally limited to PEM.<br><br>If anyone else knows otherwise, corrections welcome<br></pre></body></html>