On 2026-07-28T11:35:30, Sergio Prado <[email protected]> wrote: > binman: x509_cert: document PKCS#11 URI support in keyfile > > The 'keyfile' entry argument of an x509 certificate entry is passed > straight to 'openssl -key', which on OpenSSL 3.x resolves it through the > STORE API. Any URI the STORE API understands therefore already works, > including a PKCS#11 URI (RFC 7512) naming a key held in a hardware > security module. > > Nothing in binman had to change for that, but nothing said so either. > Document the forms 'keyfile' accepts - a PEM key file on disk, a PKCS#11 > URI, or a PKCS#11 URI prefixed with 'org.openssl.engine:<engine>:' for > setups which only have the older pkcs11 engine - along with the OpenSSL > configuration they need and the two ways of supplying the token PIN for > unattended signing. > > PKCS#11 signing needs OpenSSL 3.x. The provider API and the > 'org.openssl.engine:' STORE scheme both appeared in 3.0, and OpenSSL 4.0 > removed the ENGINE API altogether [1], so the engine form is specific to > 3.x while the provider form is the one to build on. OpenSSL 1.x is not > supported. > > When a PIN is given both in openssl.cnf via pkcs11-module-token-pin and > as a pin-value attribute in the URI, the URI wins. This was measured > with SoftHSM2 and the pkcs11 provider on OpenSSL 3.4.1. > > Add testX509CertPkcs11, which signs against a SoftHSM2 token with the > PIN carried in the URI and skips cleanly when the OpenSSL pkcs11 > provider is not installed. Add testX509CertKeyfile too, which checks > that the 'keyfile' property is read and that the entry argument > overrides it; it uses an image description of its own rather than > x509_cert.dts, so that the file naming a nonexistent key cannot trip up > tests which just want a signed certificate. > > [1] https://openssl-library.org/post/2025-12-18-remove-engines/ > > Signed-off-by: Sergio Prado <[email protected]> > > tools/binman/binman.rst | 52 +++++++++++++ > tools/binman/etype/x509_cert.py | 4 +- > tools/binman/ftest.py | 96 > ++++++++++++++++++++++++ > tools/binman/test/fit/openssl_provider.conf | 14 ++++ > tools/binman/test/security/x509_cert_keyfile.dts | 25 ++++++ > 5 files changed, 190 insertions(+), 1 deletion(-)
Reviewed-by: Simon Glass <[email protected]>
