1

I've asked a question on SO, but was directed here since it might align better with this SE.

The problem I have is that I need to extract the certificate and key in unencrypted PEM format for use in an application on a system that is highly controlled. Since the system (and network) are limited in their available tools (no access to OpenSSL and additional Python libraries like pyOpenSSL), I'm currently looking to implement a solution to extract the information needed from the ground up as necessary using standard library modules from Python 3.

Here is where I am currently at:

  • I've got a .p12 and the password is known; how do I apply the password and read the file?
  • After I can read the file, how do I extract the certificate and key?

Constraints:

  • Targeted system is Windows 10
  • Desired implementation will be using Python 3
  • No additional tools can be added
  • Any native Windows tools are authorized (excluding PS)

Once I can figure out how to read the file since I know the password, I can move on to extracting the information I need...or so I think.

Additional Info: Testing to see how to access .p12 content

Using a personal system and a test .p12 I can use:

openssl pkcs12 -info -in <file> -passin pass:<password>

And the terminal prints out:

MAC Iteration 100000
MAC verified OK
PKCS7 Data
Shrouded Keybag: PBES2, PBKDF2, AES-128-CBC, Iteration 100000, PRF hmacWithSHA1
Bag Attributes
    friendlyName: PKCS8ShroudedKeyBag from PKIjs
    localKeyID: C7 E0 11 96
    Microsoft CSP Name: http://www.pkijs.org
Key Attributes
    X509v3 Key Usage: 80

Then the terminal prompts for:

Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:

And finally outputs:

-----BEGIN ENCRYPTED PRIVATE KEY-----
...
-----END ENCRYPTED PRIVATE KEY-----
PKCS7 Encrypted data: PBES2, PBKDF2, AES-128-CBC, Iteration 100000, PRF hmacWithSHA1
Certificate bag
Bag Attributes
    friendlyName: CertBag from PKIjs
    localKeyID: 6A 6F BD 1B
    Microsoft CSP Name: http://www.pkijs.org
subject=/C=US/CN=\x00P\x00e\x00c\x00u\x00l\x00i\x00a\x00r\x00 \x00V\x00e\x00n\x00t\x00u\x00r\x00e\x00s
issuer=/C=US/CN=\x00P\x00e\x00c\x00u\x00l\x00i\x00a\x00r\x00 \x00V\x00e\x00n\x00t\x00u\x00r\x00e\x00s
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
|improve this question
  • What is the target system? Windows? How recent? What version of Powershell? How were you planning to implement your solution? PS, VBS, BAT? When you say "limited in tools (namely OpenSSL)" does that mean that the target system does or does not have OpenSSL? – gowenfawr Jun 6 '19 at 20:38
  • @gowenfawr Please see my edited post for clarification. – pstatix Jun 6 '19 at 20:40
  • @gowenfawr Furthermore, I'm not in need of a full solution. If somebody could even just tell me the steps of how to read the binary file (i.e. what encoding is used on the raw bytes) and how to apply the password to it to extract the data that would be enough! – pstatix Jun 6 '19 at 23:47
  • FYI: openssl pkcs12 (import) outputs privatekey unencrypted if you add -nodes (yes, that spelling should be obsolete). But you say you can't use openssl. – dave_thompson_085 Jun 7 '19 at 5:45
  • @dave_thompson_085 Correct. So I need to figure out a way to read the encoded binary file and get the information out. However, I'm not sure how the file is encoded (other than I know its not UTF-8) nor do I know how to apply the password a user set to it in order to extract said information. – pstatix Jun 8 '19 at 23:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.