0

I'm looking to the use the estreamer python library for Cisco firepower. To achieve this, the configuration document states the following about using clients:

"you need to create a certificate on the Defense Center or managed device for the computer where you want to run the client. You then download the certificate file to the client computer and use it to create a certificate ( server.crt) and RSA key file ( server.key)." Cisco Guide

I generated the pfcs12 file through FirePOWER. I tried the following steps (source) to create the certificate and RSA key file:

openssl pkcs12 -in filename.pfx -nocerts -out filename.key
openssl pkcs12 -in filename.pfx -clcerts -nokeys -out filename.crt 

When I try to run the client, I receive this error

Traceback (most recent call last):
  File "client.py", line 79, in <module>
    sys.exit(main())
  File "client.py", line 49, in main
    basedir + "test.crt", basedir + "test.pem") as ec:
  File "/usr/lib/python2.7/site-packages/estreamer/streamer.py", line 40, in __init__
    raise eStreamerKeyError("Invalid key file or bad passphrase {}".format(cert_path))
estreamer.streamer.eStreamerKeyError: Invalid key file or bad passphrase /home/admin/estreamer-client/test.crt

Am I doing something wrong when generating the cert and key?

1

It seems that the error message for eStreamerKeyError indicated the .crt file as the source of the issue when it was actually the private key file.

This ended up being the correct command for the private key:

openssl pkcs12 -in test.pkcs12 -out test.pem -nodes

I also had to download the SSL cert:

openssl s_client -showcerts -connect 172.16.10.42:443
  • If this solved your problem please accept this answer as that's the common practice here. – J.J May 18 '18 at 7:12
0

Wrong filenames?

You created two files named filename.crt and filename.key.

Try renaming to the filenames the Python script seems to be looking for: test.crt and test.pem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.