2

I am using SoftHSM along with the OpenSSL PKCS11 library for the HSM and I can create certificates and sign so I know the interactivity is working.

I've created a certificate whose private key is stored on the HSM but I'd like to be able to create a .P12 file containing both the certificate's public key and the pointer for the HSM private key.

Does OpenSSL support this? The OpenSSL PKCS12 command doesn't have a parameter for -keyform so I can't tell it to look at the engine for the key pointer. I've also tried to extract the pointer to a separate file by using OpenSSL RSAUTL but that doesn't work either.

Ultimately I'm trying to get to the same behavior you see when using certificates from smart cards...ie you can import them to your local user/machine store and it shows you have the private key (even though it's just a pointer).

Thank You!

Improve this question

1 Answer 1

Reset to default
2

Highly doubt PKCS#12 supports that.

How do you expect the 'pointer' to behave? Some UUID that's recognized as existing on external HSM, and also identifying the HSM where it exists?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .