Choose OpenSSL provider or engine automatically

Do not rely on manual configuration, choose engine usage for older
releases, but switch to provider on recent enough versions.

Sanity/utils/pkcs11-tools/runtest.sh

@@ -32,7 +32,8 @@
 BACKUP_RESOLV=""
 SOURCE_RESOLV="/etc/resolv.conf"
 : ${ENGINE:=pkcs11}
-: ${USE_ENGINE:=y}
+# auto to choose based on release, y to force engine usage
+: ${USE_ENGINE:=auto}
 
 make_openssl_conf() {
 	cat << EOF
@@ -54,7 +55,7 @@ activate = 1
 [pkcs11_sect]
 module = ${PROVIDER_MODULE}
 pkcs11-module-path = ${SOFTHSM2_MODULE}
-pkcs11-module-token-pin = ${PIN_SOURCE}
+pkcs11-module-token-pin = file:${PIN_SOURCE}
 activate = 1
 EOF
 }
@@ -125,8 +126,16 @@ rlJournalStart
 
     rlPhaseStartTest "Test DNSSEC operations on token"
         DNSSEC_ENGINE=""
+        if [ "$USE_ENGINE" = auto ]; then
+            if rlIsRHEL '<10' || rlIsFedora '<32' || rlIsCentOS '<10'; then
+                USE_ENGINE='y'
+            fi
+        fi
         if [ "$USE_ENGINE" = y ]; then
-            DNSSEC_ENGINE="-E $ENGINE"
+                rlLog "Using OpenSSL engine, legacy mode"
+                DNSSEC_ENGINE="-E $ENGINE"
+            else
+                rlLog "Not using engine, using OpenSSL provider"
         fi
 	rlRun "dnssec-keyfromlabel -a RSASHA256 $DNSSEC_ENGINE -l \"$ZSK_URI?pin-source=$PIN_SOURCE\" test" 0 "Import dnssec ZSK"
 	rlRun "dnssec-keyfromlabel -a RSASHA256 $DNSSEC_ENGINE -l \"$KSK_URI?pin-source=$PIN_SOURCE\" -f KSK test" 0 "Import dnssec KSK"