Background: I have a .pfx file from a microsoft CA that some appliance dislikes, but openssl considers it valid. I can use openssl to rewrite the pkcs12 file, trimming away some unnecessary attributes.
openssl pkcs12 -in original.pfx -nodes | openssl pkcs12 -export -out remade.pfx
Question: How can I inspect the .pfx to find out what exactly the appliance trips on?
I tried naivelly dissecting it with asn1parse, which goes down the asn.1 rabbit hole for a few levels, but a) is ultimately defeated by encryption (The PFX in question is a pkcs12, which contains pkcs7-data, which contains a pkcs8ShroudedKeyBag, which contains ciphertext) and b) misses CA certificates.
Next time I'll let RFC 7292 section 4 be my guide and post the answer if I manage to find it.
EDIT: Actually, the path all the way to the encrypted key are already excellently described over here: https://security.stackexchange.com/a/203377/185953 . The key itself is not very interesting, which leaves only the path to dissecting and decrypting the CA certificates.