Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 32 additions & 17 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,62 +1,76 @@
# cryptoauth-openssl-engine

Configuration:
## Configuration

Most of the configuration of the library can be done in lib/openssl/eccx08_engine.h or via defines during build

The exception to this is in eccx08_platform.c where key slots are defaulted
The exception to this is in eccx08_platform.c where key slots are defaulted.

If the ATCA_OPENSSL_ENGINE_STATIC_CONFIG define is set to 1 then device and signer certificate definitions will
have to be linked into the library at build.
have to be linked into the library at build.

e.g. see the line in the makefile: #LIBATECCSSL_OBJECTS += cert_def_1_signer.c cert_def_2_signer.c


Makfile:
## Makefile

The makefile included in this archive is fairly basic and is not what one would consider appropriate for a package
so there is likely some manual configuration that would be needed at this stage

so there is likely some manual configuration that would be needed at this stage.

To build the library:

> make libateccssl
```sh
make libateccssl
```

To run the test program:

> make test
```sh
make test
```

To extract certificates (if the engine is added to the openssl.cnf file):

> openssl engine ateccx08 -t -post GET_DEVICE_CERT:./device.der
> openssl engine ateccx08 -t -post GET_SIGNER_CERT:./signer.der
```sh
openssl engine ateccx08 -t -post GET_DEVICE_CERT:./device.der
openssl engine ateccx08 -t -post GET_SIGNER_CERT:./signer.der
```

Otherwise you'll have to use an interactive openssl session (see openssl engine -h and engine -vvv for details)

> openssl

```sh
$ openssl
OpenSSL> engine dynamic -pre SO_PATH:/<full path to libeccssl.so> -pre LIST_ADD:1 -pre ID:ateccx08 -pre LOAD
OpenSSL> engine ateccx08 -t -post GET_DEVICE_CERT:./device.der
OpenSSL> engine ateccx08 -t -post GET_SIGNER_CERT:./signer.der
```

Then to verify the certs:
> openssl x509 -in device.der -inform der -text -noout
> openssl x509 -in signer.der -inform der -text -noout

```sh
openssl x509 -in device.der -inform der -text -noout
openssl x509 -in signer.der -inform der -text -noout
```

To set up your openssl.cnf file

Find which openssl.cnf file your instance is using you can:

> openssl version -a | grep OPENSSLDIR
```sh
$ openssl version -a | grep OPENSSLDIR
OPENSSLDIR: "/usr/lib/ssl"
```

will tell you the base location where openssl is looking for the openssl.cnf file. It may be a symbolic link to another location

> ls -l /usr/lib/ssl
```sh
$ ls -l /usr/lib/ssl
lrwxrwxrwx 1 root root 14 Apr 24 15:22 certs -> /etc/ssl/certs
lrwxrwxrwx 1 root root 20 Jan 31 05:53 openssl.cnf -> /etc/ssl/openssl.cnf
```

To set up the openssl.cnf to use the engine:

```text
# At the top:

openssl_conf = openssl_init
Expand All @@ -75,6 +89,7 @@ engine_id = ateccx08
dynamic_path = <full path to libateccssl.so>
device_key_slot = 0
init = 0
```

To use the engine in an application you can reference the openssl tests (test/openssl/test_engine.c) but the basic principle is that
if the openssl.cnf file is configured correctly all an application really needs to do is add a call to OPENSSL_config if it is not already
Expand Down