I'm not sure off the top of my head how to configure a TPM backed key with gRPC with OpenSSL3.
With BoringSSL, one can implement the PrivateKeySigner interface to use a private key in a more generalized way. OpenSSL experts might have a key path specification or configuration for OpenSSL3+ to still use a TPM. It looks like there might be a way to configure with `OSSL_PROVIDER` directly prior to initializing gRPC. We don't currently have an API in gRPC to hide and configure the `OSSL_PROVIDER` out of the box. On Mon, Jun 29, 2026 at 1:53 AM Vishakha Rastogi <[email protected]> wrote: > Hello, > > I am using gRPC built with a custom OpenSSL version. > > - *gRPC:* 1.62.0 > - *OpenSSL:* 3.2.6 > > I am creating a TPM-backed private key using the following command: > openssl genpkey -provider tpm2 -provider base -algorithm RSA -out test.key > > Previously, when using the TPM engine (tpm2tss), I was able to pass the > private key to gRPC by specifying the key path with the engine:tpm2tss > prefix. > > Since the engine is now deprecated and I have migrated to the TPM2 > provider, I am unable to pass the TPM-backed private key to gRPC. > > Could you please advise on the correct way to use a TPM2 provider-based > private key with gRPC/OpenSSL? > > On Monday, June 22, 2026 at 11:01:31 PM UTC+5:30 Gregory Cooke wrote: > >> Hello, >> >> Can you tell us some more about your setup - are you using gRPC built >> with a custom OpenSSL version, or are you using a pre-built gRPC release? >> Further, can you provide a code snippet of how you tried to load the >> private key? >> >> We have a PrivateKeySigner API. >> <https://github.com/grpc/grpc/blob/3e1d845d437633917b7451bae9d226836658c0bb/include/grpc/private_key_signer.h#L35>However, >> using this API is only supported with the standard BoringSSL build. >> On Thursday, June 11, 2026 at 9:17:33 AM UTC-4 Vishakha Rastogi wrote: >> >>> Hi everyone, >>> >>> I am trying to secure a gRPC connection using OpenSSL 3 with private >>> keys stored in a TPM. >>> >>> The private key was generated using the TPM2 OpenSSL provider, and I can >>> successfully access and use the key through OpenSSL. However, when I >>> provide the TPM-backed private key reference/path to the gRPC server for >>> TLS configuration, gRPC reports that the private key is missing or cannot >>> be loaded. >>> >>> My questions are: >>> >>> 1. Does gRPC support TPM2/OpenSSL provider-based keys directly? >>> 2. Is there a way to configure gRPC to use a TPM-backed private key >>> without exporting the key material? >>> 3. Has anyone successfully integrated OpenSSL 3 providers >>> (specifically TPM2 provider) with gRPC TLS credentials? >>> >>> Environment: >>> >>> - gRPC: 1.62.0 >>> - OpenSSL: 3.2.6 >>> - TPM2 OpenSSL Provider: 1.1.1 >>> >>> Any guidance or examples would be greatly appreciated. >>> >>> Thanks! >>> >> -- > You received this message because you are subscribed to a topic in the > Google Groups "grpc.io" group. > To unsubscribe from this topic, visit > https://groups.google.com/d/topic/grpc-io/OuM1-8b4DTw/unsubscribe. > To unsubscribe from this group and all its topics, send an email to > [email protected]. > To view this discussion visit > https://groups.google.com/d/msgid/grpc-io/98560ee6-62f4-4499-821e-248340bbda2cn%40googlegroups.com > <https://groups.google.com/d/msgid/grpc-io/98560ee6-62f4-4499-821e-248340bbda2cn%40googlegroups.com?utm_medium=email&utm_source=footer> > . > -- You received this message because you are subscribed to the Google Groups "grpc.io" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/d/msgid/grpc-io/CABxndOyGb7jLMdi9UihaJSDT3x3NRVUC4ox9ikuPvpG7%3DD%2BjcA%40mail.gmail.com.
