Hi @klali thank yo u for sharing. I'm trying to use Openssl engine in my project. Following your code I was able to enable engine and load private key to engine (by calling O.ENGINE_load_private_key()). But I have problem to find the correct ctx to pass to SSL_CTX_use_PrivateKey(). I'm using twisted here is my code

from twisted.internet.ssl import ContextFactory, DefaultOpenSSLContextFactory
from OpenSSL import SSL, crypto

class EngineOpenSSLContextFactory(ContextFactory):

    _context = None

    def __init__(self, privateKeyFileName, certificateFileName,
                 sslmethod=SSL.SSLv23_METHOD, _contextFactory=SSL.Context):
        """
        @param privateKeyFileName: Name of a file containing a private key
        @param certificateFileName: Name of a file containing a certificate
        @param sslmethod: The SSL method to use
        """
        self.privateKeyFileName = privateKeyFileName
        self.certificateFileName = certificateFileName
        self.sslmethod = sslmethod
        self._contextFactory = _contextFactory
        self.cacheContext()

    def cacheContext(self):
        self._context = self._contextFactory(self.sslmethod)
        self.init_ssl_engine('tpm2tss')

    def init_ssl_engine(self, engine):
        _lib = ctypes.CDLL("/usr/lib/x86_64-linux-gnu/libcrypto.so")
        _lib2 = ctypes.CDLL("/usr/lib/x86_64-linux-gnu/libssl.so")

        _lib.ENGINE_load_builtin_engines()
        e = _lib.ENGINE_by_id(b"tpm2tss")
        if e == None:
            raise ValueError('Cannot find engine {}'.format(engine))

        if not _lib.ENGINE_init(e):
            _lib.ENGINE_free(e)
            raise Exception('Cannot initialize engine {}'.format(engine))

        u = _lib.UI_OpenSSL()
        key = _lib.ENGINE_load_private_key(e, b"/home/dwang3/Desktop/tls-tpm/tpm-gen-cert/tpm-client-priv.tss", u, None)

        ctx = self._context
        print(_lib2.SSL_CTX_use_PrivateKey(ctx, key))

Python3 reports "print(_lib2.SSL_CTX_use_PrivateKey(ctx, key))
ctypes.ArgumentError: argument 1: <class 'TypeError'>: Don't know how to convert parameter 1" Do you have any idea how to pass ctx in this case? Thank you again and appreciate your help!

Twisted looks like it's using pyopenssl, looking at what seems to be stored in twisted that should maybe be self._context._context.

Thank you so much @klali. I tried that as your suggested. But I still get the same error:

ctx = self._context._context
print(_lib2.SSL_CTX_use_PrivateKey(ctx, key))
print(_lib2.SSL_CTX_use_certificate_file(ctx, b"/home/dwang3/Desktop/tls-tpm/tpm-gen-cert/tpm-client-cert.pem", 1))

print(_lib2.SSL_CTX_use_PrivateKey(ctx, key))
ctypes.ArgumentError: argument 1: <class 'TypeError'>: Don't know how to convert parameter 1

I'm actually using ctypes not the OpenSSL._util. Here is my setup:

import ctypes
_lib = ctypes.CDLL("/usr/lib/x86_64-linux-gnu/libcrypto.so")
_lib2 = ctypes.CDLL("/usr/lib/x86_64-linux-gnu/libssl.so")

I assume it should not matter but I do not know if it makes a difference?

Second question, When I import OpenSSL._util as your code. Python reports error as following do you know why? Did I do something wrong?

_lib.ENGINE_load_builtin_engines()
AttributeError: module 'lib' has no attribute 'ENGINE_load_builtin_engines'
or 
AttributeError: module 'lib' has no attribute 'ENGINE_load_dynamic'

Thank you so much for your help!

This was useful to me, wanted to share a cleaner (IMO) way of accessing the context object with ssl:

You have this:

ctx = ctypes.cast(id(context) + ctypes.sizeof(ctypes.c_void_p) * 2, ctypes.POINTER(ctypes.c_void_p)).contents

This also works:

from ctypes import c_void_p, sizeof
ctx = c_void_p.from_address(id(context) + sizeof(c_void_p) * 2)

from_address uses the value at the given address to create the c_void_p.

Second question, When I import OpenSSL._util as your code. Python reports error as following do you know why? Did I do something wrong?

_lib.ENGINE_load_builtin_engines()
AttributeError: module 'lib' has no attribute 'ENGINE_load_builtin_engines'
or 
AttributeError: module 'lib' has no attribute 'ENGINE_load_dynamic'

You probably need to use cryptography==2.5 as cryptography==2.6.1 remove a lot of "unused" function.
Commit: