'\" te .\" Copyright (c) 2009, 2015, Oracle and/or its affiliates. All rights reserved. .TH openssl 5 "22 May 2015" "SunOS 5.12" "Standards, Environments, and Macros" .SH NAME openssl \- OpenSSL cryptographic and Secure Sockets Layer toolkit .SH DESCRIPTION .sp .LP OpenSSL is a cryptography toolkit that implements the Transport Layer Security (TLS v1) network protocols. This version of OpenSSL no longer supports the Secure Sockets Layer (SSLv2/v3) network protocols. .sp .LP The following features are omitted from the binaries for issues including but not limited to patents, trademark, and US export restrictions: ECC, IDEA, MDC2, RC3, RC5, 4758_CCA Engine, AEP Engine, Atalla Engine, CHIL Engine, CSWIFT Engine, GMP Engine, NURON Engine, PadLock Engine, Sureware Engine, and UBSEC Engine. .SS "The Dynamic Engine Support" .sp .LP The dynamic engine support has been enabled, which allows an external engine, in the form of a shared library, to be dynamically bound and used by an OpenSSL-based application. .sp .LP Run the following command to see if the dynamic engine is supported: .sp .in +2 .nf $ \fBopenssl engine dynamic\fR (dynamic) Dynamic engine loading support .fi .in -2 .sp .SS "The PKCS#11 Engine" .sp .LP The PKCS#11 engine has been included with ENGINE name \fBpkcs11\fR. The engine was developed in Sun and is not integrated in the OpenSSL project. .sp .LP The PKCS#11 engine is a dynamic engine, and it is configured to use the Oracle Solaris Cryptographic Framework. See \fBcryptoadm\fR(1M) for configuration information. .sp .LP The PKCS#11 engine can support the following set of mechanisms: \fBCKM_AES_CBC\fR, \fBCKM_AES_ECB\fR, \fBCKM_BLOWFISH_CBC\fR, \fBCKM_DES_CBC\fR, \fBCKM_DES_ECB\fR, \fBCKM_DES3_CBC\fR, \fBCKM_DES3_ECB\fR, \fBCKM_DSA\fR, \fBCKM_MD5\fR, \fBCKM_RC4\fR, \fBCKM_RSA_PKCS\fR, \fBCKM_RSA_X_509\fR, \fBCKM_SHA_1\fR, \fBCKM_SHA224\fR, \fBCKM_SHA256\fR, \fBCKM_SHA384\fR, \fBCKM_SHA512\fR, \fBCKM_SHA224_HMAC\fR, \fBCKM_SHA224_HMAC_GENERAL\fR, and \fBCKM_SHA224_KEY_DERIVATION\fR. .sp .LP The set of mechanisms available depends on installed Crypto Framework providers. To see what mechanisms can be offloaded to the Cryptographic Framework through the PKCS#11 engine on a given machine, run the following command: .sp .in +2 .nf $ \fB/usr/bin/openssl engine dynamic -pre SO_PATH:/lib/openssl/engines/64/libpk11.so -pre LOAD -t -c\fR .fi .in -2 .sp .sp .LP In order to verify the use of the PKCS#11 engine and the use of hardware acceleration with the OpenSSL application, you must specify the EVP option. EVP stands for \fBEnVeloPE\fR API, which is the API applications such as Apache use to access OpenSSL cryptography. Use the EVP option to get the most accurate \fBopenssl speed\fR results. .sp .in +2 .nf $ \fB/usr/bin/openssl speed -evp aes-128-cbc -engine pkcs11\fR .fi .in -2 .sp .sp .LP Due to requirements of the PKCS#11 standard regarding \fBfork\fR(2) behavior, some applications that use the OpenSSL EVP interfaces and \fBfork()\fR with active \fBcrypto\fR contexts might experience unexpected behavior. .SS "Using FIPS Mode" .sp .LP FIPS-140 capable OpenSSL is available in Oracle Solaris. .sp .LP The IPS package mediator feature is used to activate the non-FIPS-140 version or the FIPS-140 version of OpenSSL. .sp .LP By default, the non-FIPS-140 version (\fBdefault\fR implementation) is activated. Use the \fBpkg set-mediator\fR command to switch to the FIPS-140 version of OpenSSL: .sp .in +2 .nf # \fBpkg set-mediator -I fips-140 openssl\fR .fi .in -2 .sp .sp .LP To switch back to the default non-FIPS-140 version, use the following command: .sp .in +2 .nf # \fBpkg set-mediator -I default openssl\fR .fi .in -2 .sp .sp .LP Reboot is required to enforce the change system-wide. .sp .LP See \fIManaging Encryption and Certificates in Oracle Solaris 11.2\fR for more details. .sp .LP When the FIPS-140 version of OpenSSL is activated, an application can run in FIPS-140 mode or non-FIPS-140 mode. An application must explicitly call \fBFIPS_mode_set()\fR in order to activate FIPS-140 mode. .SS "Building an OpenSSL Application" .sp .LP To build an OpenSSL application, use the following \fBcc\fR command line options: .sp .in +2 .nf cc [ \fIflag\fR... ] \fIfile\fR... -lcrypto -lssl [ \fIlibrary\fR... ] .fi .in -2 .SS "Accessing RSA Keys in PKCS#11 Keystores" .sp .LP OpenSSL can access RSA keys in PKCS#11 keystores using the following functions of the ENGINE API: .sp .in +2 .nf EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id, UI_METHOD *ui_method, void *callback_data) EVP_PKEY *ENGINE_load_public_key(ENGINE *e, const char *key_id, UI_METHOD *ui_method, void *callback_data) .fi .in -2 .sp .LP \fBkey_id\fR, formerly for filenames only, can be now also set to a \fBPKCS#11 URI\fR. The \fBEVP_PKEY\fR structure is newly allocated and caller is responsible to free the structure later. To avoid clashes with existing filenames, \fBfile://\fR prefix for filenames is now also accepted but only when the PKCS#11 engine is in use. The PKCS#11 URI specification follows: .sp .in +2 .nf pkcs11:[token=