Re: Cannot read exported PKCS12 cert and private key

"Gary L Peskin" <garyp@xxxxxxxxxxxx> · Mon, 13 Mar 2017 09:26:21 -0700

Thanks VERY much Michael.  That did the trick.  This was a homegrown CA cert and I needed it to sign a certificate request for testing purposes.

I didn’t realize that the openssl pkcs12 utility didn’t support PEM encoding for input.  I was a little confused I guess by the documentation which shows PEM encoding for “-in filename” but I see now that that’s for when exporting a PKCS#12 file, not for parsing one.

Thanks again for clearing this up.  It’s weird that MS supports this input format but openssl does not. I thought openssl could do EVERYTHING.  😊

Thanks,
Gary

From: openssl-users [mailto:openssl-users-bounces@xxxxxxxxxxx] On Behalf Of Michael Wojcik
Sent: Monday, March 13, 2017 8:58 AM
To: openssl-users@xxxxxxxxxxx
Subject: Re:  Cannot read exported PKCS12 cert and private key

I'll assume you mean you exported it "from a mainframe system" using RACF. RACF has half a dozen export formats for certificates and keys; they're not all supported by OpenSSL.

In particular (and despite the PEM delimiters), I suspect what you have here is a PKCS#12 file in PEM format. The openssl pkcs12 utility doesn't support PEM encoding, because that's not normally done. RACF will do it, though, just to be difficult.

openssl asn1parse -in file -inform pem shows you have valid ASN.1 data, with a big ol' blob at offset 26; adding -strparse 26 shows encrypted data. So yes, looks like PKCS#12.

So, try this:
1. Edit the file and remove the PEM delimiters ("---- BEGIN CERTIFICATE ----" and "----- END CERTIFICATE ----").
2. Convert the data from Base64 to binary:
                openssl base64 -d -in file -out file.der
3. Unpack it:
                openssl pkcs12 -in file.der -nokeys -out file-cert.pem
                openssl pkcs12 -in file.der -nocerts -out file-key.pem

Note the final openssl command will prompt you for the password to encrypt the key file with; if you don't want your private key encrypted, you can also specify -nodes.

You can use openssl pkcs12 just once, without the -nokeys / -nocerts options, but that will put your certificate and key in the same file, which is generally not what you want with OpenSSL.

Of course, you haven't told us what you're trying to do, so I'm just guessing.

Also, I can't verify this, because I don't have the import password for your PKCS#12 file.

Michael Wojcik 
Distinguished Engineer, Micro Focus 

From: openssl-users [mailto:openssl-users-bounces@xxxxxxxxxxx] On Behalf Of Gary L Peskin
Sent: Monday, March 13, 2017 08:39
To: openssl-users@xxxxxxxxxxx
Subject: Re:  Cannot read exported PKCS12 cert and private key

My original message accidently included an attachment.  Please ignore the attachment.  That was not related to this issue.

Thanks,
Gary

From: Gary L Peskin [mailto:garyp@xxxxxxxxxxxx] 
Sent: Monday, March 13, 2017 2:28 AM
To: 'openssl-users@xxxxxxxxxxx' <openssl-users@xxxxxxxxxxx>
Subject: Cannot read exported PKCS12 cert and private key

Hello all

I exported a certificate and corresponding private key in base 64 encoded DER format from a mainframe system and FTP’d it to my Windows desktop.

I tried to read it using OpenSSL 1.0.2.k and 1.1.0d 32-bit and 64-bit on Windows with 

openssl pkcs12  -in mycert.p12  -noout

But I get the following messages:

15956:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:.\crypto\asn1\tasn_dec.c:1199:
15956:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:.\crypto\asn1\tasn_dec.c:374:Type=PKCS12

I’m able to import this with the private key into the Windows certificate store with no issues.

Can someone please advise as to what I’m doing wrong?

Thanks,
Gary

PS Here is the file: