Remove OpenSSL ENGINE code

CMakeLists.txt

@@ -631,9 +631,6 @@ check_symbol_exists(SSL_get_all_async_fds openssl/ssl.h TS_USE_TLS_ASYNC)
 check_symbol_exists(OSSL_PARAM_construct_end "openssl/params.h" HAVE_OSSL_PARAM_CONSTRUCT_END)
 check_symbol_exists(TLS1_3_VERSION "openssl/ssl.h" TS_USE_TLS13)
 check_symbol_exists(MD5_Init "openssl/md5.h" HAVE_MD5_INIT)
-check_symbol_exists(ENGINE_load_dynamic "openssl/engine.h" HAVE_ENGINE_LOAD_DYNAMIC)
-check_symbol_exists(ENGINE_get_default_RSA "openssl/engine.h" HAVE_ENGINE_GET_DEFAULT_RSA)
-check_symbol_exists(ENGINE_load_private_key "openssl/engine.h" HAVE_ENGINE_LOAD_PRIVATE_KEY)
 check_symbol_exists(sysctlbyname "sys/sysctl.h" HAVE_SYSCTLBYNAME)
 
 if(SSLLIB_IS_OPENSSL3)

src/iocore/net/SSLUtils.cc

@@ -60,9 +60,6 @@
 #endif
 #include <openssl/dh.h>
 #include <openssl/ec.h>
-#if HAVE_ENGINE_LOAD_DYNAMIC
-#include <openssl/engine.h>
-#endif
 #include <openssl/err.h>
 #include <openssl/evp.h>
 #include <openssl/objects.h>
@@ -770,10 +767,6 @@ void
 SSLPostConfigInitialize()
 {
   if (SSLConfigParams::engine_conf_file) {
-#if HAVE_ENGINE_LOAD_DYNAMIC
-    ENGINE_load_dynamic();
-#endif
-
     OPENSSL_load_builtin_modules();
     if (CONF_modules_load_file(SSLConfigParams::engine_conf_file, nullptr, 0) <= 0) {
       char err_buf[256] = {0};
@@ -858,42 +851,25 @@ SSLPrivateKeyHandler(SSL_CTX *ctx, const char *keyPath, const char *secret_data,
 {
   // SSL_CTX_use_PrivateKey() takes its own reference on the key, so this
   // reference must be released on every exit.
-  scoped_PKEY pkey;
-#if HAVE_ENGINE_GET_DEFAULT_RSA && HAVE_ENGINE_LOAD_PRIVATE_KEY
-  ENGINE *e = ENGINE_get_default_RSA();
-  if (e != nullptr) {
-    pkey.reset(ENGINE_load_private_key(e, keyPath, nullptr, nullptr));
-    if (pkey) {
-      if (!SSL_CTX_use_PrivateKey(ctx, pkey.get())) {
-        Dbg(dbg_ctl_ssl_load, "failed to load server private key from engine");
-        return false;
-      }
-    }
-  }
-#else
-  void *e = nullptr;
-#endif
-  if (pkey == nullptr) {
-    scoped_BIO bio(BIO_new_mem_buf(secret_data, secret_data_len));
+  scoped_BIO bio(BIO_new_mem_buf(secret_data, secret_data_len));
 
-    pem_password_cb *password_cb = SSL_CTX_get_default_passwd_cb(ctx);
-    void            *u           = SSL_CTX_get_default_passwd_cb_userdata(ctx);
+  pem_password_cb *password_cb = SSL_CTX_get_default_passwd_cb(ctx);
+  void            *u           = SSL_CTX_get_default_passwd_cb_userdata(ctx);
 
-    pkey.reset(PEM_read_bio_PrivateKey(bio.get(), nullptr, password_cb, u));
-    if (nullptr == pkey) {
-      Dbg(dbg_ctl_ssl_load, "failed to load server private key (%.*s) from %s", secret_data_len < 50 ? secret_data_len : 50,
-          secret_data, (!keyPath || keyPath[0] == '\0') ? "[empty key path]" : keyPath);
-      return false;
-    }
-    if (!SSL_CTX_use_PrivateKey(ctx, pkey.get())) {
-      Dbg(dbg_ctl_ssl_load, "failed to attach server private key loaded from %s",
-          (!keyPath || keyPath[0] == '\0') ? "[empty key path]" : keyPath);
-      return false;
-    }
-    if (e == nullptr && !SSL_CTX_check_private_key(ctx)) {
-      Dbg(dbg_ctl_ssl_load, "server private key does not match the certificate public key");
-      return false;
-    }
+  scoped_PKEY const pkey{PEM_read_bio_PrivateKey(bio.get(), nullptr, password_cb, u)};
+  if (nullptr == pkey) {
+    Dbg(dbg_ctl_ssl_load, "failed to load server private key (%.*s) from %s", secret_data_len < 50 ? secret_data_len : 50,
+        secret_data, (!keyPath || keyPath[0] == '\0') ? "[empty key path]" : keyPath);
+    return false;
+  }
+  if (!SSL_CTX_use_PrivateKey(ctx, pkey.get())) {
+    Dbg(dbg_ctl_ssl_load, "failed to attach server private key loaded from %s",
+        (!keyPath || keyPath[0] == '\0') ? "[empty key path]" : keyPath);
+    return false;
+  }
+  if (!SSL_CTX_check_private_key(ctx)) {
+    Dbg(dbg_ctl_ssl_load, "server private key does not match the certificate public key");
+    return false;
   }
 
   return true;