Skip to content

feat: openssl tls.key_file pkcs11: #11611

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
itzwam wants to merge 8 commits into
base: master
Choose a base branch
from
Open

feat: openssl tls.key_file pkcs11: #11611

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
979ffa1
feat: openssl tls.key_file pkcs11:
itzwam Mar 23, 2026
4d7de5b
fix: warn on empty key_password
itzwam Mar 23, 2026
e539b41
fix: openssl engine support error
itzwam Mar 23, 2026
956963f
Apply suggestions from code review
itzwam Mar 23, 2026
9f377b3
fix: openssl engine support error
itzwam Mar 23, 2026
f6ca4b0
fix: Broken OPENSSL_NO_ENGINE guard causes compilation failure.
itzwam Mar 23, 2026
d623d92
fix: err handling
itzwam Mar 23, 2026
b1861d1
fix: redacted pkcs11URI
itzwam Mar 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 58 additions & 11 deletions src/tls/openssl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/opensslv.h>
#include <openssl/engine.h>
#include <openssl/x509v3.h>

#ifdef FLB_SYSTEM_MACOS
Expand Down Expand Up @@ -906,24 +907,70 @@ static void *tls_context_create(int verify,
ret = SSL_CTX_use_certificate_chain_file(ssl_ctx, crt_file);
if (ret != 1) {
ERR_error_string_n(ERR_get_error(), err_buf, sizeof(err_buf)-1);
flb_error("[tls] crt_file '%s' %lu: %s",
crt_file, ERR_get_error(), err_buf);
flb_error("[tls] crt_file '%s' error: %s",
crt_file, err_buf);
goto error;
}
}

/* key_file */
if (key_file) {
if (key_passwd) {
SSL_CTX_set_default_passwd_cb_userdata(ssl_ctx,
(void *) key_passwd);
if (strncmp(key_file, "pkcs11:", 7) == 0) {
#ifdef OPENSSL_NO_ENGINE
flb_error("[tls] key_file 'pkcs11:<REDACTED>': requires OpenSSL ENGINE support");
goto error;
#else
/* PKCS#11 URI detected */
if (!key_passwd || strlen(key_passwd) == 0) {
flb_warn("[tls] PKCS#11 URI may fail without a PIN/password (tls_key_passwd)");
}
ENGINE *e = ENGINE_by_id("pkcs11");
if (!e) {
ERR_error_string_n(ERR_get_error(), err_buf, sizeof(err_buf)-1);
flb_error("[tls] failed to load pkcs11 engine: %s", err_buf);
goto error;
}
if (!ENGINE_init(e)) {
ERR_error_string_n(ERR_get_error(), err_buf, sizeof(err_buf)-1);
flb_error("[tls] failed to initialize pkcs11 engine: %s", err_buf);
ENGINE_free(e);
goto error;
}
EVP_PKEY *pkey = ENGINE_load_private_key(e, key_file, NULL, (void *)key_passwd);
if (!pkey) {
ERR_error_string_n(ERR_get_error(), err_buf, sizeof(err_buf)-1);
flb_error("[tls] failed to load private key from pkcs11 uri '%s': %s", key_file, err_buf);
ENGINE_finish(e);
ENGINE_free(e);
goto error;
}
if (SSL_CTX_use_PrivateKey(ssl_ctx, pkey) != 1) {
ERR_error_string_n(ERR_get_error(), err_buf, sizeof(err_buf)-1);
flb_error("[tls] failed to use pkcs11 private key '%s': %s", key_file, err_buf);
EVP_PKEY_free(pkey);
ENGINE_finish(e);
ENGINE_free(e);
goto error;
}
EVP_PKEY_free(pkey);
ENGINE_finish(e);
ENGINE_free(e);
#endif
}
ret = SSL_CTX_use_PrivateKey_file(ssl_ctx, key_file,
SSL_FILETYPE_PEM);
if (ret != 1) {
ERR_error_string_n(ERR_get_error(), err_buf, sizeof(err_buf)-1);
flb_error("[tls] key_file '%s' %lu: %s",
key_file, ERR_get_error(), err_buf);
else
{
if (key_passwd) {
SSL_CTX_set_default_passwd_cb_userdata(ssl_ctx,
(void *) key_passwd);
}
ret = SSL_CTX_use_PrivateKey_file(ssl_ctx, key_file,
SSL_FILETYPE_PEM);
if (ret != 1) {
ERR_error_string_n(ERR_get_error(), err_buf, sizeof(err_buf)-1);
flb_error("[tls] key_file '%s' %lu: %s",
key_file, ERR_get_error(), err_buf);
goto error;
}
}

/* Make sure the key and certificate file match */
Expand Down