# HSM Howto

This documents OpenSSL engine support for private keys in HSM.

Assumptions: an OpenSSL engine configured with private key. We still require the certificate file and list of CA certificates per a regular TLS configuration.

    Thales Luna Example
    --------------------

    ...
    # Example for Thales Luna
    modparam("tls", "engine", "gem")
    modparam("tls", "engine_config", "/usr/local/etc/kamailio/thales.cnf")
    modparam("tls", "engine_algorithms", "EC")
    ...

    /usr/local/etc/kamailio/thales.cnf is an OpenSSL config format file used to
    bootstrap the engine, e.g., pass the PIN.

    ...
    # the key kamailio is mandatory
    kamailio = openssl_init

    [ openssl_init ]
    engines = engine_section

    [ engine_section ]
    # gem is the name of the Thales Luna OpenSSL engine
    gem = gem_section

    [ gem_section ]
    # from Thales documentation
    dynamic_path = /usr/lib64/engines-1.1/gem.so
    ENGINE_INIT = 0:20:21:password=1234-ABCD-5678-EFGH
    ...

    Thales nShield Connect
    ----------------------

    Place holder