Transition from ENGINE to provider API in OpenSSL 3.0: configuration implications

Answer

Load the default and legacy providers in openssl.cnf, optionally turn off the ENGINE subsystem, and be aware that loading both an ENGINE and a provider can create duplicate algorithm entries but the provider implementation takes precedence.

Configuration steps

1. Enable the provider section – make sure the configuration file points to a provider section (default name providers) via the openssl_conf variable or the OPENSSL_CONF environment variable.
2. Define the default and legacy providers – add a [providers] section that loads both providers:

openssl_conf = openssl_init

[openssl_init]
providers = provider_sect

[provider_sect]
default = default_sect
legacy = legacy_sect

[default_sect]
activate = 1

[legacy_sect]
activate = 1
# optional: specify a path if the legacy provider is built as a separate module
# path = legacy_provider.so

3. Suppress ENGINE‑related deprecation warnings – disable the ENGINE subsystem in the same [openssl_init] block:

[openssl_init]
engines = off   # prevents automatic ENGINE loading and quiets deprecation messages
providers = provider_sect

4. Reload or restart the application – after editing openssl.cnf, restart the process or re‑initialize the OpenSSL context so the new configuration is read.
5. Verify loading – run:

openssl list -providers

You should see default and legacy listed, and no ENGINE lines if engines = off is effective.

How simultaneous ENGINE and provider loading affects the algorithm table

• OpenSSL maintains two separate dispatch tables: one for the provider API and one for the legacy ENGINE API.
• When both are loaded, an algorithm that exists in both tables appears twice in utilities like openssl list -algorithms (once under the provider name, once under the ENGINE ID).
• The provider implementation is used by default for all high‑level APIs (EVP, SSL, etc.). The ENGINE implementation is only invoked if the application explicitly calls ENGINE_by_id and uses the returned ENGINE.
• Thus duplicate entries do not cause functional conflicts, but they can generate deprecation warnings if the ENGINE path is exercised.

Disabling the ENGINE subsystem while keeping legacy algorithms

• Setting engines = off in the [openssl_init] section prevents OpenSSL from automatically loading any ENGINE modules.
• The legacy provider (named legacy) supplies algorithms such as MD5, RC4, DES, etc., so they remain accessible via the normal provider‑based EVP interface.
• There is no way to remove the ENGINE code from the library itself, but disabling it at runtime stops its use and eliminates the associated warnings.