title: Nginx configuration with engine_ssl pkcs11 for set TLS connections
body: <p>Please help me with nginx configuration on Windows for use TLS connections based on PKCS#11 engine.</p>
  
  <p>I have driver pkcs11 (C:\nCipher\nfast\toolkits\pkcs11\cknfast-64.dll) from provider.</p>
  
  <p>My nginx.conf file looks like: </p>
  
  <pre><code>worker_processes  1;
  
  events {
      worker_connections  1024;
  }
  
  #nShield PKCS#11
  ssl_engine pkcs11;
  
  
  http {
      ...
      server {
          listen       8888;
          server_name localhost;
          return 301 https://$server_name$request_uri;
      }
  
      server {
          listen       443 ssl;
          listen [::]:443 ssl;
  
          server_name localhost;
  
          ssl_certificate      C:/nginx-1.16.1/ssl/test_selfcert;
          ssl_certificate_key  "engine:pkcs11:pkcs11:token=ocs2;object=test_key";
  
          ssl_session_cache    shared:SSL:1m;
          ssl_session_timeout  5m;
  
          ssl_ciphers TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-GCM-SHA256:TLS13-AES-256-GCM-SHA384:ECDHE:!COMPLEMENTOFDEFAULT;
          ssl_prefer_server_ciphers on;
          ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
  
          location / {
               proxy_pass http://localhost:9999/;
               proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
               proxy_set_header X-Forwarded-Proto $scheme;
               proxy_set_header X-Forwarded-Port $server_port;
          }
      }
  
  }
  </code></pre>
  
  <p>I tried to check this config and get error:</p>
  
  <pre><code>&gt;nginx -t
  nginx: [emerg] ENGINE_by_id("pkcs11") failed (SSL: error:25078067:DSO support routines:win32_load:could not load the shared library:filename(Z:\nginx\nginx-stab
  le\objs.msvc8\lib\openssl-1.1.1c\openssl\lib\engines-1_1\pkcs11.dll) error:25070067:DSO support routines:DSO_load:could not load the shared library error:260B60
  84:engine routines:dynamic_load:dso not found error:2606A074:engine routines:ENGINE_by_id:no such engine:id=pkcs11)
  nginx: configuration file C:\nginx-1.16.1/conf/nginx.conf test failed
  </code></pre>
  
  <p>I think there is an error in my openssl configuration because I did not define the pkcs11 driver there.
  At the end of the default configuration C:\nCipher\nfast\lib\ssleay\openssl.cnf I added a block like:</p>
  
  <pre><code>...
  openssl_conf            = openssl_def
  [openssl_def]
  engines = engine_section
  
  [engine_section]
  chil = chil_section
  
  [chil_section]
  SO_PATH=c:\\Program Files (x86)\\nCipher\\nfast\\toolkits\\hwcrhk\\nfhwcrhk.dll
  
  #added
  [engine_section]
  pkcs11 = pkcs11_section
  [pkcs11_section]
  engine_id = pkcs11
  dynamic_path = "C:\\Program Files\\OpenSSLx64\\bin\\pkcs11openssl64x.dll"
  MODULE_PATH = "C:\\nCipher\\nfast\\toolkits\\pkcs11\\cknfast-64.dll"
  init = 0
  ...
  </code></pre>
  
  <p>But file pkcs11openssl64x.dll is NOT exist on my computer! In 'dynamic_path' param I tried to download and use  files libpkcs11-helper-1.dll, onepin-opensc-pkcs11.dll, opensc_pkcs11.ddl , but all of them not working. When I tried to use this configuration without 'dynamic_path' param, i get error:</p>
  
  <pre><code>&gt; openssl engine -t -c pkcs11
  13112:error:25078067:DSO support routines:WIN32_LOAD:could not load the shared library:dso_win32.c:179:filename(C:\Program Files\Git\mingw64\lib\engines\pkcs11.
  dll)
  13112:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:233:
  13112:error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:467:
  13112:error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:411:id=pkcs11
  </code></pre>
  
  <p>or with use config path:</p>
  
  <pre><code>&gt; openssl engine -t -c pkcs11  -config "C:\nCipher\nfast\lib\ssleay\openssl.cnf"
  13572:error:25078067:DSO support routines:WIN32_LOAD:could not load the shared 
  library:./crypto/dso/dso_win32.c:179:filename(C:\nCipher\nfast\bin\pkcs11.dll)
  13572:error:25070067:DSO support routines:DSO_load:could not load the shared library:./crypto/dso/dso_lib.c:233:
  13572:error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:./crypto/engine/eng_dyn.c:467:
  13572:error:2606A074:engine routines:ENGINE_by_id:no such engine:./crypto/engine/eng_list.c:391:id=pkcs11
  13572:error:25078067:DSO support routines:WIN32_LOAD:could not load the shared library:./crypto/dso/dso_win32.c:179:filename(C:\nCipher\nfast\bin\-config.dll)
  13572:error:25070067:DSO support routines:DSO_load:could not load the shared library:./crypto/dso/dso_lib.c:233:
  13572:error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:./crypto/engine/eng_dyn.c:467:
  13572:error:2606A074:engine routines:ENGINE_by_id:no such engine:./crypto/engine/eng_list.c:391:id=-config
  13572:error:25078067:DSO support routines:WIN32_LOAD:could not load the shared library:./crypto/dso/dso_win32.c:179:filename(C:\nCipher\nfast\lib\ssleay\\openss
  l.cnf)
  13572:error:25070067:DSO support routines:DSO_load:could not load the shared library:./crypto/dso/dso_lib.c:233:
  13572:error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:./crypto/engine/eng_dyn.c:467:
  13572:error:2606A074:engine routines:ENGINE_by_id:no such engine:./crypto/engine/eng_list.c:391:id=C:\nCipher\nfast\lib\ssleay\openssl.cnf
  </code></pre>
  
  <p>But I'm expecting the next:</p>
  
  <pre><code>&gt; openssl engine -t -c pkcs11
  (pkcs11) pkcs11 engine
  [RSA, rsaEncryption, id-ecPublicKey]
  [ available ]
  </code></pre>
  
  <p>Also no pkcs#11 driver are detected when outputting:</p>
  
  <pre><code>&gt;openssl engine -t -c
  (dynamic) Dynamic engine loading support
       [ unavailable ]
  (chil) CHIL hardware engine support
   [RSA, DH, RAND]
       [ available ]
  </code></pre>
  
  <p>Please help me to set the correct configuration for NGINX to work with TLS connection setup.</p>