Hi all, When the openssl interactive mode was still possible, you could set up an engine and then use it as follows: OpenSSL> engine -t dynamic -pre SO_PATH:/usr/lib64/openssl/engines/engine_pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/lib64/pkcs11/onepin-opensc-pkcs11.so OpenSSL> req -engine pkcs11 -new -key 0:7f72c103216c285f28d0a05bcf87678e25b0f1e2 -keyform engine -out matthew.csr What is the equivalent of the above in openssl3? Regards, Graham —