I have installed Apache on my Centos7 virtual machine together with mod_ssl. I'm trying to make TLS working with the private key protected by an HSM over PKCS#11, but when I try to start Apache it doesn't find my private key (see the error below). Also nothing gets written in the logs of our PKCS#11 library.
On the other hand if I try to use OpenSSL directly from the command line with the same PKCS#11 URI, it is able to communicate with the HSM backend and identify the key. Also logs of the PKCS#11 library appear.
openssl rsautl -engine pkcs11 -keyform engine -inkey 'pkcs11:type=private?pin-value=121212;token=VendorPKCS11;id=%51' -sign -in myinputfile.txt -out myoutputfile.txt For me it looks like Apache is not loading our PKCS#11 library for some reason and I don't know why. I found this in Google but it is was not very detailed.
Here's what I have setup...
/etc/httpd/conf.d/ssl.conf:
(Note: apachecert.pem is self-signed using the private key on HSM.)
Listen 443 https SSLRandomSeed startup file:/dev/urandom 256 SSLRandomSeed connect builtin SSLCryptoDevice pkcs11 <VirtualHost _default_:443> DocumentRoot "/var/www/html" ServerName myserver:443 ErrorLog logs/ssl_error_log TransferLog logs/ssl_access_log LogLevel warn SSLEngine on SSLProtocol all -SSLv2 -SSLv3 SSLCipherSuite HIGH:3DES:!aNULL:!MD5:!SEED:!IDEA SSLCertificateFile /etc/pki/tls/apachecert.pem SSLCertificateKeyFile "pkcs11:type=private?pin-value=121212;token=VendorPKCS11;id=%51" </VirtualHost> /etc/pki/tls/openssl.cnf:
openssl_conf = openssl_def [openssl_def] engines = engine_section [engine_section] pkcs11 = pkcs11_section [pkcs11_section] engine_id = pkcs11 dynamic_path = /usr/lib64/openssl/engines/libpkcs11.so MODULE_PATH = /etc/pki/tls/libVendorPKCS11.so init = 0 /etc/pki/tls/VendorPKCS11.properties:
log.folder.path=/etc/pki/tls/p11logs log.level=5 delay.between.auto.recovery.attempts=300 authentication.mode=TICKET portal.server.list=node1 token.label=VendorPKCS11 token.manufacturer.id=Vendor token.model=HSM Portal Token token.serial.number=1 token.max.pin.length=1024 token.min.pin.length=1 token.hardware.version=1.0 token.firmware.version=1.0 slot.description=Vendor HSM Portal PKCS11 slot.manufacturer.id=Vendor slot.hardware.version=1.0 slot.firmware.version=1.0 info.cryptoki.interface.version=2.20 info.manufacturer.id=Vendor info.library.description=HSM Portal based PKCS11 library info.library.version=2.0 credentials.user.name=username portal.node1.uri=backendserver:8999 portal.node1.certificate.path=/etc/pki/tls/rootcer.pem portal.node1.concurrent.clients=2 timeout.connection=15000 timeout.command=60000 timeout.keep.alive=600000 The error I see when trying to start Apache:
Oct 22 08:55:25 myserver systemd[1]: Starting The Apache HTTP Server... Oct 22 08:55:25 myserver httpd[11013]: AH00526: Syntax error on line 112 of /etc/httpd/conf.d/ssl.conf: Oct 22 08:55:25 myserver httpd[11013]: SSLCertificateKeyFile: file '/etc/httpd/pkcs11:type=private?pin-value=121212;token=VendorPKCS11;id=%51' does not exist or is empty Oct 22 08:55:25 myserver systemd[1]: httpd.service: main process exited, code=exited, status=1/FAILURE Oct 22 08:55:25 myserver kill[11015]: kill: cannot find process "" Oct 22 08:55:25 myserver systemd[1]: httpd.service: control process exited, code=exited status=1 Oct 22 08:55:25 myserver systemd[1]: Failed to start The Apache HTTP Server. Oct 22 08:55:25 myserver systemd[1]: Unit httpd.service entered failed state. Oct 22 08:55:25 myserver systemd[1]: httpd.service failed. Does anyone has an idea why Apache is not able to find the vendor PKCS#11 library or at least any logs don't show up? Also I find it strange that in the error output of Apache, something adds "/etc/httpd/" in front of the PKCS#11 URI.
