I've asked a question on SO, but was directed here since it might align better with this SE.
The problem I have is that I need to extract the certificate and key in unencrypted PEM format for use in an application on a system that is highly controlled. Since the system (and network) are limited in their available tools (no access to OpenSSL and additional Python libraries like pyOpenSSL), I'm currently looking to implement a solution to extract the information needed from the ground up as necessary using standard library modules from Python 3.
Here is where I am currently at:
- I've got a .p12 and the password is known; how do I apply the password and read the file?
- After I can read the file, how do I extract the certificate and key?
Constraints:
- Targeted system is Windows 10
- Desired implementation will be using Python 3
- No additional tools can be added
- Any native Windows tools are authorized (excluding PS)
Once I can figure out how to read the file since I know the password, I can move on to extracting the information I need...or so I think.
Additional Info: Testing to see how to access .p12 content
Using a personal system and a test .p12 I can use:
openssl pkcs12 -info -in <file> -passin pass:<password>
And the terminal prints out:
MAC Iteration 100000
MAC verified OK
PKCS7 Data
Shrouded Keybag: PBES2, PBKDF2, AES-128-CBC, Iteration 100000, PRF hmacWithSHA1
Bag Attributes
friendlyName: PKCS8ShroudedKeyBag from PKIjs
localKeyID: C7 E0 11 96
Microsoft CSP Name: http://www.pkijs.org
Key Attributes
X509v3 Key Usage: 80
Then the terminal prompts for:
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
And finally outputs:
-----BEGIN ENCRYPTED PRIVATE KEY-----
...
-----END ENCRYPTED PRIVATE KEY-----
PKCS7 Encrypted data: PBES2, PBKDF2, AES-128-CBC, Iteration 100000, PRF hmacWithSHA1
Certificate bag
Bag Attributes
friendlyName: CertBag from PKIjs
localKeyID: 6A 6F BD 1B
Microsoft CSP Name: http://www.pkijs.org
subject=/C=US/CN=\x00P\x00e\x00c\x00u\x00l\x00i\x00a\x00r\x00 \x00V\x00e\x00n\x00t\x00u\x00r\x00e\x00s
issuer=/C=US/CN=\x00P\x00e\x00c\x00u\x00l\x00i\x00a\x00r\x00 \x00V\x00e\x00n\x00t\x00u\x00r\x00e\x00s
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
openssl pkcs12
(import) outputs privatekey unencrypted if you add-nodes
(yes, that spelling should be obsolete). But you say you can't useopenssl
. – dave_thompson_085 Jun 7 '19 at 5:45