Loading…
The OpenSSL Conference is the global meeting place for the people who build, deploy, govern, and rely on secure digital infrastructure. It brings together developers, security engineers, researchers, policymakers, enterprises, legal and compliance professionals, and community contributors, all united by a shared commitment to stronger open-source security.
Wednesday October 14, 2026 11:30 - 12:00 CEST
For most of OpenSSL's history a release was signed with the release manager's own OpenPGP key β€” the 1.1.1 and 3.0.0 tags carry signatures from different individuals. Automating the release process consolidated that onto one shared release key, but it was still a private key in a file on disk. Either way, the trust root for software that a large chunk of the internet depends on to build TLS was a file that could be copied. This talk covers moving that trust root onto hardware β€” an Entrust nShield HSM in FIPS 140-3 mode β€” without breaking release automation and without changing anything for verifiers. We cover: the two-tier key model (a Certify-only primary key under a card quorum, plus a signing subkey the pipeline uses unattended); sq-pkcs11, the open-source Rust CLI on Sequoia-OpenPGP we built to bridge OpenPGP and PKCS#11; the redesigned pipeline with an isolated signing stage; nshield-card-check, a small web app for custodians to verify their card and passphrase on demand with an audit trail; and generalizing the same HSM to sign RPM/DEB repos and Java code. Attendees leave with a concrete reference architecture that runs against SoftHSM2 as well as real hardware.
Speakers
DM

Dmitry Misharov

DevOps Engineer, OpenSSL Corporation
Dmitry Misharov is a Senior DevOps Engineer at OpenSSL Corporation, working on the infrastructure behind OpenSSL: release automation, the HSM-backed signing pipeline, and performance testing infrastructure. Dmitry designed and built the release-signing migration this talk covers... Read More →
Wednesday October 14, 2026 11:30 - 12:00 CEST
Room 2
  Technical, Talk

Sign up or log in to save this to your schedule, view media, check-in, leave feedback and see who's attending!

Share Modal

Share this link via

Or copy link