An OpenSSL 3.x Provider that enables using AWS KMS asymmetric keys for cryptographic operations including signing, verification, encryption, and decryption.
Your private keys never leave AWS KMS. This provider allows you to use KMS-managed keys directly with OpenSSL, meaning:
- 🔐 Private keys cannot be stolen - Even with full server compromise, the key material stays in KMS
- 🚫 Easy revocation - Instantly revoke access via IAM policies
- 📋 Full audit trail - Every key operation is logged in CloudTrail
- ✅ Hardware security - Keys are protected by FIPS 140-2 validated HSMs
This provider integrates seamlessly with existing OpenSSL-based tooling and workflows:
- Web servers - Configure HTTPS/TLS termination without storing private keys on disk
- Mutual TLS - Authenticate services using client certificates backed by KMS
- PKI operations - Generate CSRs, issue certificates, or run a private CA
- Code & document signing - Sign artifacts, S/MIME messages, or timestamps
- Serverless - Usable as a Lambda Layer for secure signing in AWS Lambda functions
Download prebuilt binaries from the Releases page.
💡 AWS Lambda: The release zips can be used directly as Lambda Layers. See the included README for setup instructions.
cargo build --releaseRequirements:
- Rust 1.65.0 or later
- OpenSSL 3.x development libraries
The library will be built at target/release/libkms_provider.so (Linux) or libkms_provider.dylib (macOS).
# Set up environment
export KMS_KEY_ID="arn:aws:kms:eu-west-1:123456789:key/your-key-id"
export OPENSSL_MODULES=/path/to/provider
export OPENSSL_CONF=/path/to/openssl-kms-standalone.cnf
# Test: display the public key
openssl pkey -in "aws-kms:${KMS_KEY_ID}" -pubout -textKeys are referenced using the aws-kms: URI scheme:
aws-kms:<key-id-or-arn>
Supported formats: Key ID, Key ARN, Alias Name, or Alias ARN.
Sign a file:
openssl dgst -sha256 -sign "aws-kms:${KMS_KEY_ID}" -out sig.bin data.txtCreate a self-signed certificate:
openssl req -new -x509 -days 365 -subj '/CN=My Service/' -sha256 \
-key "aws-kms:${KMS_KEY_ID}" -out cert.pemCreate a CSR:
openssl req -new -subj '/CN=My Service/' -sha256 \
-key "aws-kms:${KMS_KEY_ID}" -out request.csrDecrypt data (RSA only):
openssl pkeyutl -decrypt -inkey "aws-kms:${KMS_KEY_ID}" \
-in encrypted.bin -out decrypted.bin \
-pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:SHA256| Operation | RSA | EC (P-256/384/521) | Notes |
|---|---|---|---|
| Sign | ✅ | ✅ | Via KMS Sign API |
| Verify | ✅ | ✅ | Local verification with public key from KMS |
| Decrypt | ✅ | ❌ | Via KMS Decrypt API (OAEP) |
| Encrypt | ✅ | ❌ | Local encryption with public key |
Supported algorithms:
- RSA: PKCS#1 v1.5 and PSS padding with SHA-256/384/512
- ECDSA: P-256, P-384, P-521 with SHA-256/384/512
- Decryption: RSAES-OAEP with SHA-1 or SHA-256
| Variable | Description |
|---|---|
OPENSSL_MODULES |
Path to the directory containing the provider library |
OPENSSL_CONF |
Path to the OpenSSL configuration file |
OPENSSL_PROVIDER_KMS_LOG |
Log level (e.g., kms_provider=debug or trace) |
This provider implements the OpenSSL 3.x Provider API:
| Component | OpenSSL Operation | Purpose |
|---|---|---|
| Store | OSSL_OP_STORE |
Handles aws-kms: URI scheme |
| Keymgmt | OSSL_OP_KEYMGMT |
RSA and EC key management |
| Signature | OSSL_OP_SIGNATURE |
RSA/ECDSA signing via KMS |
| Asymmetric Cipher | OSSL_OP_ASYM_CIPHER |
RSA encryption/decryption |
cargo testTests include comprehensive coverage with a mock KMS client for offline testing.
This project was inspired by and builds upon the excellent work of:
-
Nuutti Kotivuori - Author of openssl-kms-provider, the original OpenSSL engine for AWS KMS that served as the foundation and inspiration for this provider implementation.
-
James Bottomley - Author of openssl_tpm2_engine and the invaluable blog post Converting Engines to OpenSSL 3 Providers, which provided essential guidance on implementing OpenSSL 3.x providers.
This project is licensed under the GNU Lesser General Public License v3.0 or later.