add support for mbedtls

[cobradevil]

Hello caml-crush developers,

This is a feature request to have support for mbedtls (formarly known as polarssl).
We are already using openvpn with polarssl because this is easier to analyse then openssl.

We are looking into caml-crush for using it as a HSM. We already have a test setup with nginx as a reverse proxy with caml-crush as the HSM like solution. Also the wiki seems outdated when it comes to using nginx with caml-crush because the limitiation of running nginx with master_process and deamon off is already fixed in recent versions of libp11.
Based on closed issue https://github.com/ANSSI-FR/caml-crush/issues/15 and OpenSC/libp11#39

Best regards,
William

[calderonth]

@cobradevil For mbedtls support, are you talking about the client library TLS support only (doable as we support OpenSSL/GnuTLS) or also the server aspect of Caml Crush, where we use ocaml-ssl/Ocamlnet for this, in which case: support for mbedtls should be a request to those projects. Also note, that depending on OCamlnet version the underlying TLS library is exclusive and changes (OpenSSL for 3.x and GnuTLS for 4.x).

[calderonth]

@cobradevil also we'd be grateful if you can post an updated nginx configuration sample for to update the wiki, given you have a working setup.

[cobradevil]

@calderonth
nginx for ubuntu 16.04

create the file: /etc/systemd/system/nginx.service.d/override.conf with the following content:
Environment=OPENSSL_CONF=/etc/nginx/openssl.conf

then run: systemctl daemon-reload

then create the file: /etc/nginx/openssl.conf with the following contents:
openssl_conf = openssl_def
[openssl_def]
engines = engine_section
[engine_section]
pkcs11 = pkcs11_section
[pkcs11_section]
engine_id = pkcs11
dynamic_path = /usr/lib/ssl/engines/libpkcs11.so
MODULE_PATH=/usr/local/lib/libp11clienthsmproxy.so
init = 1
PIN = 1234

now create the nginx vhost with the following ssl settings:
ssl_certificate
/etc/nginx/certs/server.pem;
ssl_certificate_key engine:pkcs11:slot_0-id_01;

[cobradevil]

@calderonth ,

it would be nicer for the server component but then the upstream projects would need to implement it so that is a bigger issue.
If you could support it for the client side at least, I would be greatfull.

Best regards,
William

[rben-dev]

Issue accepted as a feature request.

[calderonth]

Hi again @cobradevil, we welcome contribution for this open source project.
Could you work on a sample patch/pull request for the mbedtls client library support?

[cobradevil]

Hi @calderonth ,
if I would have the skills then I would make the contribution.