Build-time IBMCA configuration
During package configuration via ./configure it is checked whether
IBMCA is built against OpenSSL version 3.0 or later, or against an earlier OpenSSL version. Only if built against OpenSSL version 3.0 or later, the package is configured to
also build the IBMCA provider, if not explicitly
disabled using option --disable-provider. Regardless of the OpenSSL version, IBMCA engine is built by default. However, this can be disabled
via --disable-engine if desired.
Distributors will most likely either build the IBMCA engine, or the IBMCA provider, dependent if the distribution uses OpenSSL ≥ 3.0 or not. A package installation via
make install installs both, the IBMCA engine as well as the IBMCA provider to the directory specified with
--libdir during configuration (or the default directory respectively). However, to
be able to be used with OpenSSL, engines need to be
installed into the OpenSSL directory that is
obtained with the ENGINESDIR variable, for example, /lib64/engines-3, while
providers need to be installed into the OpenSSL
directory that is obtained with the MODULESDIR variable, for example,
/lib64/ossl-modules (see step 2 in Installing IBMCA from the source package).
It is the distributor's responsibility to install the engines and providers into the right directories. This can for example be accomplished within the RPM spec file.