Whether to make the OpenSSL pkcs11 engine available to wpa_supplicant, for EAP-TLS authentication with client keys on PKCS#11 tokens such as smartcards or a TPM. With networking.wireless.enableHardening enabled, the service is additionally granted: Membership in security.tpm2.tssGroup. Access to the TPM device configured by security.tpm2.tctiEnvironment.deviceConf. pcscd socket for smartcard readers. Access to default system-wide token store /etc/tpm2_pkcs11. Note that the hardened service by default has no home directory, so only the system store location applies. The store must be writable by security.tpm2.tssGroup. Enable security.tpm2.pkcs11.enable option to grant tss group access to the store. wpa_supplicant loads the engine through OpenSSL’s dynamic engine mechanism, which only searches OpenSSL’s own store path; This option points the search path (the OPENSSL_ENGINES environment variable) at the configured libp11 package instead, which shadows OpenSSL’s built-in engine directory rather than extending it. wpa_supplicant never requests the engines shipped there (afalg, capi, loader_attic, padlock), so this is normally invisible. A configuration that nevertheless loads one of them by name inside this service (e.g. through a custom OPENSSL_CONF) can restore the union of both directories: networking.wireless.pkcs11.package = pkgs.symlinkJoin { name = "wpa-supplicant-engines"; paths = [ pkgs.libp11 ]; postBuild = "ln -s ${pkgs.openssl.out}/lib/engines-3/*.so $out/lib/engines/"; };

false