Hello, I am using gRPC built with a custom OpenSSL version.
- *gRPC:* 1.62.0 - *OpenSSL:* 3.2.6 I am creating a TPM-backed private key using the following command: openssl genpkey -provider tpm2 -provider base -algorithm RSA -out test.key Previously, when using the TPM engine (tpm2tss), I was able to pass the private key to gRPC by specifying the key path with the engine:tpm2tss prefix. Since the engine is now deprecated and I have migrated to the TPM2 provider, I am unable to pass the TPM-backed private key to gRPC. Could you please advise on the correct way to use a TPM2 provider-based private key with gRPC/OpenSSL? On Monday, June 22, 2026 at 11:01:31 PM UTC+5:30 Gregory Cooke wrote: > Hello, > > Can you tell us some more about your setup - are you using gRPC built with > a custom OpenSSL version, or are you using a pre-built gRPC release? > Further, can you provide a code snippet of how you tried to load the > private key? > > We have a PrivateKeySigner API. > <https://github.com/grpc/grpc/blob/3e1d845d437633917b7451bae9d226836658c0bb/include/grpc/private_key_signer.h#L35>However, > > using this API is only supported with the standard BoringSSL build. > On Thursday, June 11, 2026 at 9:17:33 AM UTC-4 Vishakha Rastogi wrote: > >> Hi everyone, >> >> I am trying to secure a gRPC connection using OpenSSL 3 with private keys >> stored in a TPM. >> >> The private key was generated using the TPM2 OpenSSL provider, and I can >> successfully access and use the key through OpenSSL. However, when I >> provide the TPM-backed private key reference/path to the gRPC server for >> TLS configuration, gRPC reports that the private key is missing or cannot >> be loaded. >> >> My questions are: >> >> 1. Does gRPC support TPM2/OpenSSL provider-based keys directly? >> 2. Is there a way to configure gRPC to use a TPM-backed private key >> without exporting the key material? >> 3. Has anyone successfully integrated OpenSSL 3 providers >> (specifically TPM2 provider) with gRPC TLS credentials? >> >> Environment: >> >> - gRPC: 1.62.0 >> - OpenSSL: 3.2.6 >> - TPM2 OpenSSL Provider: 1.1.1 >> >> Any guidance or examples would be greatly appreciated. >> >> Thanks! >> > -- You received this message because you are subscribed to the Google Groups "grpc.io" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/d/msgid/grpc-io/98560ee6-62f4-4499-821e-248340bbda2cn%40googlegroups.com.
