Acceptance criteria:

• Implement support for alternative OpenSSL engines.

  • There are potentially two different engines.

  • One is specified in the `HttpsClient` section of the config, and is used for client certificates.

  • The other is specified in `Security`, and is used for signing the auth request.

  • If it’s difficult to have two engines, then it’s fine to give an error if they are not identical.

  • Same for the key, they can be different, but it’s fine to produce error if they are not identical.

• It’s required that this code pass the tests with “mtls” in their name in the integration tests.

It’s heavily recommended to use the Golang implementation as inspiration, since this is so hard to test. Some good starting points are the EngineById and EngineLoadPrivateKey functions, and their corresponding implementations in our openssl Golang library fork.