Re: [PATCH v6 2/5] binman: x509_cert: document PKCS#11 URI support in keyfile

On 2026-07-28T11:35:30, Sergio Prado <[email protected]> wrote:
> binman: x509_cert: document PKCS#11 URI support in keyfile
>
> The 'keyfile' entry argument of an x509 certificate entry is passed
> straight to 'openssl -key', which on OpenSSL 3.x resolves it through the
> STORE API. Any URI the STORE API understands therefore already works,
> including a PKCS#11 URI (RFC 7512) naming a key held in a hardware
> security module.
>
> Nothing in binman had to change for that, but nothing said so either.
> Document the forms 'keyfile' accepts - a PEM key file on disk, a PKCS#11
> URI, or a PKCS#11 URI prefixed with 'org.openssl.engine:<engine>:' for
> setups which only have the older pkcs11 engine - along with the OpenSSL
> configuration they need and the two ways of supplying the token PIN for
> unattended signing.
>
> PKCS#11 signing needs OpenSSL 3.x. The provider API and the
> 'org.openssl.engine:' STORE scheme both appeared in 3.0, and OpenSSL 4.0
> removed the ENGINE API altogether [1], so the engine form is specific to
> 3.x while the provider form is the one to build on. OpenSSL 1.x is not
> supported.
>
> When a PIN is given both in openssl.cnf via pkcs11-module-token-pin and
> as a pin-value attribute in the URI, the URI wins. This was measured
> with SoftHSM2 and the pkcs11 provider on OpenSSL 3.4.1.
>
> Add testX509CertPkcs11, which signs against a SoftHSM2 token with the
> PIN carried in the URI and skips cleanly when the OpenSSL pkcs11
> provider is not installed. Add testX509CertKeyfile too, which checks
> that the 'keyfile' property is read and that the entry argument
> overrides it; it uses an image description of its own rather than
> x509_cert.dts, so that the file naming a nonexistent key cannot trip up
> tests which just want a signed certificate.
>
> [1] https://openssl-library.org/post/2025-12-18-remove-engines/
>
> Signed-off-by: Sergio Prado <[email protected]>
>
> tools/binman/binman.rst                          | 52 +++++++++++++
>  tools/binman/etype/x509_cert.py                  |  4 +-
>  tools/binman/ftest.py                            | 96 ++++++++++++++++++++++++
>  tools/binman/test/fit/openssl_provider.conf      | 14 ++++
>  tools/binman/test/security/x509_cert_keyfile.dts | 25 ++++++
>  5 files changed, 190 insertions(+), 1 deletion(-)

Reviewed-by: Simon Glass <[email protected]>