Background: I have a .pfx file from a microsoft CA that some appliance dislikes, but openssl considers it valid. I can use openssl to rewrite the pkcs12 file, trimming away some unnecessary attributes.

openssl pkcs12 -in original.pfx -nodes | openssl pkcs12 -export -out remade.pfx

Question: How can I inspect the .pfx to find out what exactly the appliance trips on?

I tried naivelly dissecting it with asn1parse, which goes down the asn.1 rabbit hole for a few levels, but a) is ultimately defeated by encryption (The PFX in question is a pkcs12, which contains pkcs7-data, which contains a pkcs8ShroudedKeyBag, which contains ciphertext) and b) misses CA certificates.

Next time I'll let RFC 7292 section 4 be my guide and post the answer if I manage to find it.

EDIT: Actually, the path all the way to the encrypted key are already excellently described over here: https://security.stackexchange.com/a/203377/185953 . The key itself is not very interesting, which leaves only the path to dissecting and decrypting the CA certificates.

  • Just look at the output from pkcs12 (import) [-nodes] without or before re-exporting it; that shows the attributes as textual 'comments'. (Note the subject= and issuer= values are extracted from the cert body(ies), they are not attributes.) – dave_thompson_085 Sep 12 '19 at 4:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.