+++ This bug was initially created as a clone of Bug #2011993 +++ Description of problem: OpenSSL 3 deprecated use of Engines[1], which we use and require from freeipa as a bridge with opendnssec. It seems providers [2] should be used instead to fetch different implementations of algorithms. We need PKCS11 interface now, so more recent interface should be used. But there seems no pkcs11 provider exists yet. Not provided by openssl-pkcs11 package yet, there seems no better support for it. Once there is better interface, it should be switched to providers. Seems too fresh now. 1. https://www.openssl.org/docs/man1.0.2/man3/engine.html 2. https://www.openssl.org/docs/manmaster/man7/provider.html 3. https://github.com/OpenSC/libp11 Version-Release number of selected component (if applicable): openssl-3.0.0-2.el9.x86_64 bind-9.16.20-2.el9.x86_64 --- Additional comment from Petr Menšík on 2022-08-31 19:33:50 CEST --- ISC upstream has a report that latchset on github [1] should be on a good tracks. But it does not have yet even first release, so it does not seem to be ready for production. 1. https://github.com/latchset/pkcs11-provider/
Upstream is tracking some progress at issue: https://gitlab.isc.org/isc-projects/bind9/-/issues/2996 They have even separate tag for PKCS11 related issues: https://gitlab.isc.org/isc-projects/bind9/-/issues/?label_name%5B%5D=PKCS%2311
There is PR #7276 [1]. Although that itself is not merged, it seems existing parts of it were merged independently, without referencing issue #2996. Crypto [2] tag shows not a small count of changes were already merged 1. https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/7276 2. https://gitlab.isc.org/isc-projects/bind9/-/merge_requests?scope=all&state=merged&label_name[]=Crypto
Merged PR are: https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8170 https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8258
This should have been added with rebase to 9.18.36, 9.18.35-2 contains it already.
This were implemented by Patch31: bind-9.18-pkcs11-provider.patch Should work and be used since f42.
Fixed in updates: - https://bodhi.fedoraproject.org/updates/FEDORA-2025-a97bd2a08c - https://bodhi.fedoraproject.org/updates/FEDORA-2025-ba58df94bd