how to test pkcs11(generate pkcs11.so)

[dongyeonkim01]

Hi

we are testing 'PKCS11' using LSDK 20.04

following 6.5.3.3.2 PKCS#11 based OpenSSL Engine (Third party OpenSC/libp11)

dongyeonkim01_1-1628057305775.png

we want success 'openssl engine pkcs11 -t' command 

(pkcs11) pkcs11 engine
[ available ]

but we are return errors.,..

dongyeonkim01_2-1628057573266.png

'pkcs11.so' files not found error so,

I guess cause openssl engine is not generate 'pkcs11.so' files

and our /etc/ssl/openssl.cnf

dongyeonkim01_3-1628057651410.png

thank you

[yipingwang]

Please edit /etc/ssl/openssl.cnf  as the following.

[openssl_init]
engines=engine_section
[engine_section]
pkcs11 = pkcs11_section
[pkcs11_section]
engine_id = pkcs11
dynamic_path = /usr/lib/aarch64-linux-gnu/engines-1.1/libpkcs11.so
MODULE_PATH = /usr/local/lib/libpkcs11.so
init = 0

[yipingwang]

pkcs11 engine for OpenSSL can be installed on board using command sudo apt-get install libengine-pkcs11-openssl
Above command will install the libpkcs11.so (pkcs11 engine) in /usr/lib/aarch64-linux-gnu/engines-1.1/libpkcs11.so and this
will be dynamic_path in OpenSSL configuration file.

[dongyeonkim01]

thank you for your reply

I find libpkcs11.so  file

but I make another errors

dongyeonkim01_0-1628150604392.png

and my /etc/ssl/openssl.cnf 
(chantge dynamic path, module path)

dongyeonkim01_0-1628136689556.png

+) add

How do I make image, including libpkcs11.so libaray?

I've already changed the libpkcs11=y option in the build_lsdk.cfg file.

[yipingwang]

Please enable the following options in configs/build_lsdk.cfg.

CONFIG_APP_OPTEE=y
CONFIG_APP_LIBPKCS11=y
CONFIG_APP_SECURE_OBJ=y

Then execute the following commands.

$ flex-builder -c libpkcs11 -a arm64

$ flex-builder -i merge-component -a arm64

$ flex-builder -i packrfs -a arm64

[dongyeonkim01]

I used this option to build the image.

$ flex-builder -c libpkcs11 -a arm64

$ flex-builder -i merge-component -a arm64

$ flex-builder -i packrfs -a arm64

but I should installed  'sudo apt-get install libengine-pkcs11-openssl' when I used 'openssl engine' with pkcs11

how can I include libengine-pkcs11-openssl  library into image??

[yipingwang · Accepted solution]

You could add libengine-pkcs11-openssl to additional_main_packages_list in configs/ubuntu/additional_packages_list.

Then execute the following command.

$ flex-builder -i clean-rfs -r ubuntu:main

$ flex-builder -i mkrfs -r ubuntu:main

$ flex-builder -i packrfs -r ubuntu:main