Currently i have an issue to setup my Mac with HSM

Current configuration

OS: MacOS Catalina

I'm using this configuration

openssl_conf = openssl_init

engines = engine_section

pkcs11 = pkcs11_section

engine_id = pkcs11
dynamic_path = /usr/local/Cellar/libp11/0.4.11/lib/engines-1.1/pkcs11.dylib
MODULE_PATH = /usr/local/lib/softhsm/libsofthsm2.so
init = 0

[ req ]
distinguished_name = req_dn

[ req_dn ]
commonName = foobar

Then i'm try to using this cmd for generate certification from HSM

OPENSSL_CONF=engine.conf openssl req -new -x509 -subj "/CN=MyCertTEST" -engine pkcs11 -keyform engine -key "pkcs11:object=mykey1;pin-value=mysecret1" -outform der -out mycert.der         

Note: I'm already setup key into HSM

How ever seem like it show an error as

Error configuring OpenSSL
4569882220:error:26FFF074:engine routines:CRYPTO_internal:no such engine:/AppleInternal/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-47.140.1/libressl-2.8/crypto/engine/eng_list.c:367:id=dynamic
4569882220:error:26FFF066:engine routines:CRYPTO_internal:engine configuration error:/AppleInternal/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-47.140.1/libressl-2.8/crypto/engine/eng_cnf.c:197:section=pkcs11_section, name=dynamic_path, value=/usr/local/Cellar/libp11/0.4.11/lib/engines-1.1/pkcs11.dylib
4569882220:error:0EFFF06D:configuration file routines:CRYPTO_internal:module initialization error:/AppleInternal/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-47.140.1/libressl-2.8/crypto/conf/conf_mod.c:224:module=engines, value=engine_section, retcode=-1      
failed to load configuration

Not sure where i'm missing on configuration part or any misunderstanding the way to configuration engine

Can anyone guide me on this. Thank you


This behaviour you're seeing is most likely caused by the fact that newer macOS releases use LibreSSL by default.

You can verify this by running

openssl version

in your terminal.

From your OpenSSL configuration file, I can see that you are already using brew, which means that you can simply install the openssl package and use that instead. That's what worked for me, at least.

There may also be a way to use the LibreSSL installation, but I have no idea how.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.