Failed to find and load 'cng' engine

[matbech]

The readme says to put the cng.dll into the same directory as the osslsigncode.exe executable:
"To use the CNG engine with osslsigncode, ensure that the cng.dll library is placed in the same directory as the osslsigncode.exe executable."

However, osslsigncode.exe isn't able to load the library and fails with the following error:

error : Failed to find and load 'cng' engine
error : Failed to read key or certificates
error : 60170000:error:12800067:DSO support routines:win32_load:could not load the shared library:crypto\dso\dso_win32.c:108:filename(C:\vcpkg\packages\openssl_x64-windows\lib\engines-3\cng.dll)

From the error message it seems that the cng.dll is being loaded from a hard coded directory (the OpenSSL engine default directory).

It works when tricking osslsigncode.exe to load the engine from a path by adding a dot to the engine name:
.\cng
Reason:

osslsigncode/osslsigncode.c

Line 4293 in 5ac11e9

if (strchr(id, '.')) {

Tested with version 2.10

[olszomal]

To ensure OpenSSL can find your custom engine (e.g., cng.dll) in the current directory, set the OPENSSL_ENGINES environment variable:

set OPENSSL_ENGINES=.

This is necessary because OpenSSL 3.x built via vcpkg uses a hardcoded default engine path:

ENGINESDIR = $(libdir)/engines-3

Unless you either provide the full or relative path to the DLL, or explicitly set the OPENSSL_ENGINES environment variable, OpenSSL will try to load the engine from that default directory (e.g., .../lib/engines-3/) instead of your current working directory.

I've submitted a PR #457 to improve the path detection logic for locating the engine module and to clarify the README.

[mtrojnar]

@matbech The -engine parameter was designed to accept either:

• cng to load cng.dll from your OpenSSL's ENGINESDIR. Execute openssl version -e to print it.
• cng.dll to load cng.dll from the current folder.
• C:\your\folder\cng.dll to load cng.dll from a specified folder.

I guess we may need to update the documentation, as it no longer reflects the implementation.

[mtrojnar]

All we needed here was the documentation update implemented in #457. I'm closing this issue.