Docs

OpenSSL and web servers

OpenSSL 3 loads the Roost PKCS#11 module through pkcs11-provider. Web servers and proxies built on OpenSSL then use a Roost key for TLS without any change to their own code.

openssl.cnf

[openssl_init]
providers = provider_sect

[provider_sect]
default = default_sect
pkcs11 = pkcs11_sect

[default_sect]
activate = 1

[pkcs11_sect]
module = /usr/lib/ossl-modules/pkcs11.so
pkcs11-module-path = /usr/lib/roost/libroost-pkcs11.so
activate = 1

nginx

ssl_certificate      /etc/roost/tls-www.chain.pem;
ssl_certificate_key  "engine:pkcs11:pkcs11:token=prod;object=tls-www;type=private";
ssl_session_cache    shared:SSL:10m;   # session resumption keeps the signing load low

Certificate request

roost csr tls-www --subject "CN=www.example.com" --out tls-www.csr
# the CSR is signed inside the box and carries the key's birth record
roost cert import tls-www --chain fullchain.pem   # the chain is stored next to the key