Overview

OpenSSL is an open-source project that consists of a cryptographic library and an SSL/TLS toolkit. OpenSSL provides command-line tools for cryptographic operations including symmetric encryption, public-key encryption, and digital signing hash.

Thales ProtectServer 3 HSMs can be used to securely store OpenSSL cryptographic keys. OpenSSL integrates with GemEngine to allow the consumption of HSM resources. The benefits of using ProtectServer 3 HSMs to generate the cryptographic keys for OpenSSL are the following:

• Secure generation, storage, and protection of the identity-signing private key on FIPS-validated hardware.

• Full life-cycle management of the keys.

• Significant performance improvements by offloading cryptographic operations from application servers.

  

  Note

  ProtectServer 3 integrations with OpenSSL is only supported in FIPS mode with the following versions:

  PTK Version	Security Flags
  7.3.1	Default Security Flags*
  7.3.0	FIPS 140-3
  7.2.4	FIPS 140-3

  • The following outlines the workaround scenarios for version 7.3.1:

  Customers with existing OpenSSL (older FW, with FIPS mode enabled) integrations wishing to upgrade to FW 7.03.01 and above.

  Due to the setting of the security mode flag “Tamper Before Upgrade”, direct upgrade to FW 7.03.01 is not permitted. The following steps will workaround that issue.

  • Backup the existing keys.
  • Tamper the HSM.
  • Re-initialize the HSM without FIPS mode set.
  • Upgrade to FW 7.03.01 or above.
  • Restore the key backup.
  • Enable FIPS mode.

  New customers or new integrations with FW 7.03.01 and above (no FIPS mode).

  • Initialize the HSM without FIPS mode set.
  • Upgrade to FW 7.03.01 or above.
  • Perform the integration of OpenSSL.
  • Enable FIPS mode.