title: How to reload key from HSM by using openssl?
body: <p>I'm using HSM via pkcs11 openssl engine. 
  <code>ENGINE_load_private_key()</code> is used to load keys to use. 
  It works fine, except after key pair generation: </p>
  
  <p>After generating a new key-pair to HSM, <code>ENGINE_load_private_key()</code> still returns the old key.</p>
  
  <p>Obviously later calls of <code>ENGINE_load_private_key()</code> does not read the key from HSM. Instead <code>ENGINE_load_private_key()</code> seems to return some cached value.</p>
  
  <p><strong>Is there some way to force openssl to read the new key from the HSM, and not returning some old key that does not anymore exists in the HSM?</strong></p>
  
  <p>This code piece was used to figure out the problem:</p>
  
  <pre><code>static void print_public_key_via_openssl( const char* name )
  {
      ENGINE *e = ENGINE_by_id( "pkcs11");
  
      if ( e )
      {
          if ( ENGINE_init( e ) )
          {
              EVP_PKEY* key = ENGINE_load_private_key( e, name, NULL, NULL );
              if( key )
              {
                  printf( "Public key:\n%s", public_key_to_str(key) );
                  EVP_PKEY_free( key );
              }
              ENGINE_finish( e );
          }
          ENGINE_free( e );
      }
  }
  
  int main( int argc, char** argv )
  {
      ...
  
      // Load the key and print it to stdout
      print_public_key_via_openssl( "slot_1-label_Private02" );
  
      // Generate new key pair value. 
      system( "hsmtool --dump_key 2" );
      system( "hsmtool --gen_key 2" );
      system( "hsmtool --dump_key 2" );
  
      // Load the key and print it to stdout
      print_public_key_via_openssl( "slot_1-label_Private02" );
      ...
  }
  </code></pre>
  
  <p>Result: key in the HSM did change, but openssl still returns the old key:</p>
  
  <pre><code>Public key:
      Public-Key: (256 bit)
      pub:
          04:da:6e:4a:5f:e8:80:e4:e8:07:b8:79:7c:62:f6:
          57:78:91:c4:42:89:13:da:72:61:e7:69:07:51:84:
          6a:a2:a2:74:7b:79:7b:31:74:1d:b0:74:16:d7:9f:
          fa:fd:2f:12:34:b9:80:06:16:84:c0:a3:0a:46:27:
          a5:90:30:38:c9
      ASN1 OID: prime256v1
      NIST CURVE: P-256
  
  Key #2:
      X   : DA6E4A5FE880E4E807B8797C62F6577891C4428913DA7261E7690751846AA2A2
      Y   : 747B797B31741DB07416D79FFAFD2F1234B980061684C0A30A4627A5903038C9
  
  Key #2:
      X   : D6321B2DAAC592DB1E06D43F674804D0107252012BBDD214A7BB519109DD5D6E
      Y   : 0315E667625CBECA08A1D61BD0087D20D888A41AAE0E28D8789B8BDC8F6D09FF
  
  Public key:
      Public-Key: (256 bit)
      pub:
          04:da:6e:4a:5f:e8:80:e4:e8:07:b8:79:7c:62:f6:
          57:78:91:c4:42:89:13:da:72:61:e7:69:07:51:84:
          6a:a2:a2:74:7b:79:7b:31:74:1d:b0:74:16:d7:9f:
          fa:fd:2f:12:34:b9:80:06:16:84:c0:a3:0a:46:27:
          a5:90:30:38:c9
      ASN1 OID: prime256v1
      NIST CURVE: P-256
  </code></pre>
  
  <p>Several programs will use the keypair from the HSM. And Those programs also uses other key pairs actively for TLS. So, restarting a process is not solution. </p>