Expose all config options as env variable

[ulrichb]

It would be nice to have all the config options additionally exposed as environment variable.

Currently, only PKCS11_PROVIDER_MODULE is exposed.

If a user also can pass e.g. pkcs11-module-token-pin, or pkcs11-module-quirks via env would avoid to write/set an openssl config file and everything could be passed "in memory". Okay the pin can be passed via the PKCS#11 URI, but setting it "from the environment" is better/easier in some cases.

The legacy libp11 engine also allowed to set (at least the most important) config values via env.

[petrovr]

Note that OpenSSL allows to obtain value from environment for every configuration options(directive) .

[ulrichb]

@petrovr Could you point me to docs/samples? Other than OPENSSL_CONF which points to a config file I'm not aware of any possibility.

[beldmit]

https://docs.openssl.org/3.6/man5/config/ provides some examples relying on ENV vars, but it's the best I'm aware of

[ulrichb]

Thx. I only see the $ENV::xxx expansion possibility (which still requires a config file). But not how to override arbitrary values like (for this provider) pkcs11-module-token-pin, or pkcs11-module-quirks.

[petrovr]

На 3.02.26 г. в 14:41, ulrichb написа:

*ulrichb* left a comment (openssl-projects/pkcs11-provider#616) <#616 (comment)> Thx. I only see the |$ENV::xxx| expansion possibility (which still requires a config file). But not how to override /arbitrary/ values like (for this provider) |pkcs11-module-token-pin|, or |pkcs11-module-quirks|.

a) first is work-around for OpenSSL configuration parser "This definition stops the following lines choking if ....", see default configuration. So let in common section to define defaults, see where HOME is defined PKCS11_MODULE_TOKEN_PIN = file:/etc/token/.pin PKCS11_MODULE_QUIRKS = no-deinit Remark: I guess that this part is still required. b) define in specific provider section pkcs11-module-token-pin = ${ENV::PKCS11_MODULE_TOKEN_PIN} pkcs11-module-quirks = ${ENV::PKCS11_MODULE_QUIRKS} If I'm not wrong OpenSSL 3.0 requires activate=1 to be specified i.e., provider configuration. When an application activates provider by code, it could use (3.2?) function with specific properties. From my point of view program is responsible for such configuration. Roumen

[ulrichb]

This is a feature proposal which allows to specify pkcs11-provider options like pkcs11-module-quirks from the environment without touching the OpenSSL config file.