0

我有一个简单的 openssl 引擎，我想通过openssl.conf文件加载到 OpenSSL 中。我openssl-1.1.1c使用以下配置设置从源代码安装，

./config --prefix=/opt/openssl -DOPENSSL_LOAD_CONF --openssldir=/opt/openssl

安装后$openssl version显示如下，

ss@ss:~$ openssl version
OpenSSL 1.1.1c  28 May 2019

之后，我改变openssl.conf如下，

openssl_conf = openssl_def

[openssl_def]
engines = engine_section

[engine_section]
rsa-engine-new = rsa_section

[rsa_section]
engine_id = rsa-engine-new

进行这些更改后，openssl engine命令显示以下内容，

ss@ss:/opt/openssl$ openssl engine
rsa-engine-new
(rdrand) Intel RDRAND engine
(dynamic) Dynamic engine loading support
(rsa-engine-new) engine for testing 1
139904801769216:error:260AB089:engine routines:ENGINE_ctrl_cmd_string:invalid cmd name:crypto/engine/eng_ctrl.c:255:
139904801769216:error:260BC066:engine routines:int_engine_configure:engine configuration error:crypto/engine/eng_cnf.c:141:section=rsa_section, name=oid_section, value=new_oids
139904801769216:error:0E07606D:configuration file routines:module_run:module initialization error:crypto/conf/conf_mod.c:177:module=engines, value=engine_section, retcode=-1

知道我做错了什么吗？

4

1 回答 1

0

我从 OpenSSL 邮件列表中找到了解决方案。

发生的事情是，我将新配置放在openssl.cnf文件的开头。因此，我有主要的 openssl 配置的残余。

然后我将以下部分移到openssl.cnf文件末尾

[openssl_def]
engines = engine_section

[engine_section]
rsa-engine-new = rsa_section

[rsa_section]
engine_id = rsa-engine-new
dynamic_path = (PATH_TO_OPENSSL)/lib/engines-1.1/rsa-engine-new.so

并且引擎加载没有任何错误，

$openssl engine
(rdrand) Intel RDRAND engine
(dynamic) Dynamic engine loading support
(rsa-engine-new) engine for testing 1
于 2021-08-26T19:10:36.103 回答