What Is the OpenSSL Engine API? Integrating Cloud HSMs and YubiKeys with OpenSSL

What Is the OpenSSL Engine API? While OpenSSL implements fundamental cryptographic operations such as encryption and signing on its own, it also provides a plugin-like mechanism called the Engine API that allows these operations to be delegated to external hardware. By using the Engine API, cryptographic operations provided by cloud-based HSMs (Hardware Security Modules) or other external hardware can be called transparently through OpenSSL. By delegating cryptographic operations to secure hardware such as HSMs, it becomes possible to perform operations like signing while keeping the private key stored securely on the hardware — all while still using OpenSSL. Examples of Engine API Usage One example of the Engine API in action is the pkcs11 engine plugin. This plugin enables OpenSSL to access cryptographic devices that implement the PKCS#11 interface. Google has published the Google PKCS #11 Cloud KMS Library, which allows Google Cloud HSMs to be operated via PKCS#11. By using this lib