我正在尝试安装SoftHSM,如图所示here,这需要OpenSSL。所以我安装了OpenSSL v1.0.2j,但它似乎没有捆绑的GOST支持,或者至少我在libgost.so
中找不到/usr/lib/openssl/engines
;所以我从我发现的旧版OpenSSL(v1.0.0k-2.1.x86_64)中取出它并将其放在该文件夹中。
然后,正如多个论坛所建议的那样,我修改了文件openssl.cnf(在/usr/local/ssl
中)。
在我添加RANDFIL = $ENV::HOME/.rnd
之后的行中:
openssl_conf=openssl_def
在文件的末尾:
# OpenSSL default section
[openssl_def]
engines = engine_section
# Engine section
[engine_section]
gost = gost_section
# Engine gost section
[gost_section]
engine_id = gost
dynamic_path = /usr/lib/openssl/engines/libgost.so
default_algorithms = ALL
CRYPT_PARAMS = id-Gost28147-89-CryptoPro-A-ParamSet
但仍处于SoftHSM安装的配置阶段,它显示此错误:
checking for OpenSSL GOST support... Cannot GOST engine
configure: error: OpenSSL library has no GOST support
任何帮助都将受到高度赞赏!
如果我运行此命令:openssl ciphers|tr ':' '\n'|grep GOST
,则输出为:Error configuring OpenSSL
答案 0 :(得分:5)
OpenSSL 1.1.0及更高版本不再包含GOST引擎。 From the changelog:
*) The GOST engine was out of date and therefore it has been removed. An up
to date GOST engine is now being maintained in an external repository.
See: https://wiki.openssl.org/index.php/Binaries. Libssl still retains
support for GOST ciphersuites (these are only activated if a GOST engine
is present).
[Matt Caswell]
从OpenSSL 1.0.0k复制的GOST引擎版本可能与OpenSSL 1.1.0不兼容。在更新日志中提到的网站上获取更新版本。
答案 1 :(得分:2)
我也遇到了同样的情况,我能够解决它,从而禁用了安装的GOST
下载
wget https://dist.opendnssec.org/source/softhsm-2.3.0.tar.gz
tar -xzf softhsm-2.3.0.tar.gz
cd softhsm-2.3.0
禁用GOST
./configure --disable-gost
安装
sudo make install