Using local cert file with PKCS#11 HSM private key
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 14.6k
- Forks
- 3.4k
- PR merge metrics
- No merged PRs in 30d
Description
I am trying to configure an OpenVPN client where the private key is stored on a Hardware Security Module (HSM) via PKCS#11, but the client certificate resides on the local disk.
My Goal:
Private Key: HSM (accessed via pkcs11-providers)
Client Certificate: Local file (e.g., /etc/openvpn/client.crt)
The Issue: Whenever I include both the pkcs11-id and the cert directives in my config, OpenVPN fails to start. It seems to expect that if I am using PKCS#11, the certificate must also be stored on the token.
Is there a way to do this?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The report names no source files, tests, or entry points. Start by locating the OpenVPN client configuration handling for pkcs11-id and cert, then trace how certificate and private-key sources are validated. Done means establishing whether a local certificate can be paired with a PKCS#11 private key and adding coverage or documenting the supported limitation.
Written by the indexing model from the issue text.
Assessment
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100