Adding PKCS11 provider in yocto

[ashwiniprabhug]

I am working on yocto I want to add a PKCS#11 provider so that all operations are performed using the PKCS#11 provider whenever it has an implementation. How can I configure this using a configuration file?.If the PKCS#11 provider does not support a specific operation, it should automatically fall back to OpenSSL.

[simo5]

Is this https://github.com/latchset/pkcs11-provider/blob/main/docs/provider-pkcs11.7.md#examples not clear ?
Are you trying to do something different?

[ashwiniprabhug]

I want all operations to be performed using PKCS#11, and if an implementation is not available, the OpenSSL default provider should be used instead.
Whats the configuration for that?

[ashwiniprabhug]

#601

Could you check this question too ?

[simo5]

To prefer the pkcs11-provider but still fall back you need the default properties set to
?provider=pkcs11

alg_section = algorithm_sec

[algorithm_sec]
default_properties = ?provider=pkcs11

[ashwiniprabhug]

Does openssl 3.0.14 version does not support : TLS_AES_128_CCM_8_SHA256, TLS_AES_128_CCM_SHA256 this cipher suite for tls 1.3 ?

…

________________________________ From: Simo Sorce ***@***.***> Sent: Wednesday, July 30, 2025 3:24 PM To: latchset/pkcs11-provider ***@***.***> Cc: Ashwini G ***@***.***>; Author ***@***.***> Subject: Re: [latchset/pkcs11-provider] Adding PKCS11 provider in yocto (Discussion #603) To prefer the pkcs11-provider but still fall back you need the default properties set to ?provider=pkcs11 alg_section = algorithm_sec [algorithm_sec] default_properties = ?provider=pkcs11 — Reply to this email directly, view it on GitHub<#603 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BIRRITCXGOY4FDFT2IFKC7L3LCI45AVCNFSM6AAAAACCVXGBSWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTGOJTGI3TANY>. You are receiving this because you authored the thread.Message ID: ***@***.***>