<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">Hi Michael,<br>
<br>
I see what you mean. So once I have everything setup, i use the
following to get the private key:<br>
<font size="+1" face="monospace">EVP_PKEY *pkey =
ENGINE_load_private_key(pkey_engine, pkey_identifier,
transfer_pin, &cb_data);</font><br>
<br>
Will <font size="+1" face="monospace">pkey</font> actually
contain the private key from the smart card? I thought it was not
possible to get a private key from a smart card?<br>
<br>
Once I have pkey, do I simply use it within the <i>client_cert_cb</i>
callback function?<br>
<br>
<br>
Thanks,<br>
George<br>
<br>
<br>
On 2020-12-14 10:58 a.m., Michael Wojcik wrote:<br>
</div>
<blockquote type="cite"
cite="mid:BN8PR18MB2692D804F062DDDCA66D3D24F9C70@BN8PR18MB2692.namprd18.prod.outlook.com">
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">From: openssl-users <a class="moz-txt-link-rfc2396E" href="mailto:openssl-users-bounces@openssl.org"><openssl-users-bounces@openssl.org></a> On Behalf Of George
Sent: Monday, 14 December, 2020 08:15
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap=""> Thanks for your response. It looks like I don't already have the PPP and PPPD.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
You don't need PPP to use a smartcard or other PKCS#11 device. Jan just mentioned the source as a exemplar of the interactions your code will need to have with OpenSSL.
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Are there any other ways to get the Smart Card to work without needing to
install additional software?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Probably not.
OpenSSL's PKCS#11 Engine implements the PKCS#11 API. That API needs a way to talk to the particular PKCS#11-compatible hardware you're using. That means it needs a driver, and generally some configuration as well.
It's been a few years since I last played around with this - I got OpenSSL working with a NitroKey as part of a code-signing spike - but you'll need to investigate PKCS#11 support for your particular device. There are Open Source projects such as OpenSC which may give you part or all of what you need to get OpenSSL's PKCS#11 Engine working with your hardware.
When I did it, it wasn't trivial. I spent a couple of days on investigation and experimenting before I got anything working, and a couple more days making sure I understood the entire process and documenting procedures that worked consistently. (With some applications I had persistent problems such as Windows insisting on prompting for the device PIN instead of letting me supply it programmatically, but I think that was only when using Microsoft APIs rather than going through OpenSSL.)
If the client certificate uses a public key that corresponds to a private key on the smartcard, though, that's what you'll have to do. You can't use a certificate as a proof of identity without the corresponding private key. (Some HSMs and other crypto devices have support for exporting private keys, often as multiple shares, for backup and cloning purposes. Using that to get the private key for direct use defeats the whole purpose of an HSM, of course, so that shouldn't be used to bypass the card.)
--
Michael Wojcik
</pre>
</blockquote>
<br>
</body>
</html>