Please first install the PKCS#11 Module you want to use such as OpenSC, and install libp11 (runtime and development).
Installing engine_pkcs11 is quite simple:
wget http://www.opensc.org/files/engine_pkcs11-x.y.z.tar.gz tar xfvz engine_pkcs11-x.y.z.tar.gz cd engine_pkcs11-x.y.z ./configure --prefix=/usr/ make make install
You can run the OpenSSL command shell and load the engine and then run any command using the engine. Here is an example:
$ openssl OpenSSL> engine -t dynamic -pre SO_PATH:/usr/lib/engines/engine_pkcs11.so \ -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD \ -pre MODULE_PATH:/usr/lib/opensc-pkcs11.so OpenSSL> req -engine pkcs11 -new -key id_45 -keyform engine -out req.pem -text -x509 \ -subj "/CN=Andreas Jellinghaus"
In this example the engine_pkcs11 is loaded using the PKCS#11 module opensc-pkcs11.so. The second command creates a self signed Certificate for "Andreas Jellinghaus", the signing is done using the key with id 45 from your smart card in slot 0.
You can also create/edit an openssl config file, so you don't need to type in or paste the above commands all the time. Here is an example for OpenSSL 0.9.8:
openssl_conf = openssl_def [openssl_def] engines = engine_section [engine_section] pkcs11 = pkcs11_section [pkcs11_section] engine_id = pkcs11 dynamic_path = /usr/lib/engines/engine_pkcs11.so MODULE_PATH = /usr/lib/opensc-pkcs11.so init = 0
With such a config file you can directly call openssl to use that engine:
openssl req -config openssl.conf -engine pkcs11 -new -key id_45 \ -keyform engine -out req.pem -text -x509 \ -subj "/CN=Andreas Jellinghaus"
Options you can use with engine_pkcs11:
FIXME: copied these options from the source code, untested
OpenSSL 0.9.8+ can automaticaly load engines. If you want to enable that feature, add a symlink from engine_pkcs11.so to libfoo.so in the lib/engines/ directory where engine_pkcs11.so is installed.
We think that a config file is a much better approach, since you need to pass the PKCS#11 module to use to engine_pkcs11.so, and you can do that only via command line or via the config file.