libcrypto >= 3.0.5

[gilweis]

What is the change between libcrypto 3.0.2 and libcrypto 3.0.5 that affects the library that requires minimum 3.0.5?

[simo5]

There is a change in the store loader that landed in 3.0.5 tat is required to properly select the provider the key came from.

Without this change OpenSSL always tries to export keys from the origin provider and re-import them in the default provider.

This obviously fails for private keys in pkcs11 tokens.

Technically in 3.0.2 this can be worked around by always passing the property "provider=pkcs11" in every function call, but that requires changing applications.
Or by only configuring the base and pkcs11 provider in openssl.cnf and removing the default provider, but that is not nice as then all functions not implemented in the pkcs11 provider are unavailable.

Bottom line the best way to handle this is to require 3.0.5+

[gilweis]

Thanks,
I tried to test with 3.0.2 and removing the default provider from openssl.cnf (I understand that all functions not implemented in the pkcs11 provider are unavailable now). I got an error:
openssl req...
40B76C4B067F0000:error:03000072:digital envelope routines:X509_PUBKEY_get0:decode error:../crypto/x509/x_pubkey.c:458:

[simo5]

I think the default, or at least the base provider are required to do encoding/decoding stuff.

The pkcs11-provider alone does not provide the several hundred encoding/decoding routines available in the base provider that do not require direct access to private key material.