Cristian Thiago Moecke <[email protected]> writes:
> You have two ways to follow. > > 1) To use an HSM to sign, the "official" way to do it is to use an > openssl engine. If your HSM does not provide an openssl engine, it > probably does provide a PKCS#11 module, and you can use the pkcs11 > engine to load it and use it. As a slight simplification, you can create an RSA with your own RSA_ENGINE that uses your HSM. (You only need to provide signing, so this is relatively straightforward.) Then use that in the regular signing operation. (Similarly for DSA, EC_KEY, obviously, though IIRC the EC code is still in a private header.) [...] ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
