TPM support with OpenSSL FIPS Object Module

Question

How can I use a TPM chip along with the OpenSSL FIPS Object Module without modifying OpenSSL FIPS Object Module (to avoid Private Label certification)?

Should we add an engine interface in OpenSSL module as well in OpenSSL FIPS Object Module?

Answer 1

You can start with libengine-pkcs11-openssl. It implements today only RSA keys. Or you can move to NSS instead of OpenSSL.