• add support for OpenSSL engine and loading private keys from HSM

• for when kamailio is a TLS edge proxy and needs to use HSM

• currently we initialize the engine in worker processes as PKCS#11
  libraries are not guaranteed to be fork() safe

• new config params

  • engine: name the OpenSSL engine
  • engine_config: an OpenSSL config format file used to bootstrap engines
  • engine_algorithms: list of algorithms to delegate to the engine

• tested with Gemalto SafeNet Luna (AWS CloudHSM) with RSA and EC private keys
  TLSv1.2 and PFS cipher suites

Pre-Submission Checklist

• Commit message has the format required by CONTRIBUTING guide
• Commits are split per component (core, individual modules, libs, utils, ...)
• Each component has a single commit (if not, squash them into one commit)
• No commits to README files for modules (changes must be done to docbook files
  in doc/ subfolder, the README file is autogenerated)

Type Of Change

• Small bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds new functionality)
• Breaking change (fix or feature that would change existing functionality)

Checklist:

• PR should be backported to stable branches
• Tested changes locally
• Related to issue #XXXX (replace XXXX with an open issue number)

Description

• add support for OpenSSL engine and loading private keys from HSM

• for when kamailio is a TLS edge proxy and needs to use HSM

• currently we initialize the engine in worker processes as PKCS#11
  libraries are not guaranteed to be fork() safe

• new config params

  • engine: name the OpenSSL engine
  • engine_config: an OpenSSL config format file used to bootstrap engines
  • engine_algorithms: list of algorithms to delegate to the engine

• tested with Gemalto SafeNet Luna (AWS CloudHSM) with RSA and EC private keys
  TLSv1.2 and PFS cipher suites

You can view, comment on, or merge this pull request online at:

  https://github.com/kamailio/kamailio/pull/1484

Commit Summary

• tls: add support for OpenSSL engine and private keys in HSM

File Changes

• M src/modules/tls/tls_domain.c (178)
• M src/modules/tls/tls_mod.c (91)
• M src/modules/tls/tls_mod.h (9)

Patch Links:

• https://github.com/kamailio/kamailio/pull/1484.patch
• https://github.com/kamailio/kamailio/pull/1484.diff

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.