OpenSSL C_Verify*

[0pq76r]

Is it possible to force OpenSSL to use the C_Verify* methods instead of exporting the public key and run the verify locally? Looking at the logs after running make check, I get the impression that OpenSSL always prefers the latter.

[simo5]

Yes, you should be able to do that via a quirk that prohibits exporting even public keys:

pkcs11-module-allow-export = 1

see https://github.com/latchset/pkcs11-provider/blob/main/docs/provider-pkcs11.7.md#pkcs11-module-allow-export

[0pq76r]

Thanks! I tested it with softhsm and it works as expected.