I'm using openssl to convert an exported *.p12 file into a *.pem file that has a certificate and an encrypted private key.
The P12 file was exported with a password, this is the command that I'm using to generate the PEM file:
openssl pkcs12 -clcerts -in exported.p12 -out both.pem
When I run that command I provide a PEM passphrase, the contents look like this:
Bag Attributes
friendlyName: Some Friendly Name: com.example.org
localKeyID: 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99
... other attributes omitted ...
-----BEGIN CERTIFICATE-----
MIIGijCCBXKgAwIBAgIIQzWHsGhNz0wwDQYJKoZIhvcNAQELBQAwgZYxCzAJBgNV
... contents of certificate ...
-----END CERTIFICATE-----
Bag Attributes
friendlyName: My Name
localKeyID: 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99
Key Attributes: <No Attributes>
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIQ9XzwbRcn0ACAggA
... contents of key ...
-----END ENCRYPTED PRIVATE KEY-----
After I have that PEM file; I'm trying to load it using Go's crypto/tls and crypto/x509 package, like this:
var block *pem.Block
for {
block, bytes = pem.Decode(bytes)
if block.Type == "PRIVATE KEY" || strings.HasSuffix(block.Type, "PRIVATE KEY") {
bytes, err := x509.DecryptPEMBlock(block, []byte(password))
if err != nil {
return nil, err
}
}
}
However that snippet returns the following error:
Error: fromPEMBytes: x509: no DEK-Info header in block
Reading a bit on the DEK-Info header it seems that it should look like this:
-----BEGIN ENCRYPTED PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,5B01E932988DC66B
EPESt4ZVIrxnQXxxWWVa7cCR+vgNZ/4vTu4mdq6pjaW7jMZoB8HV+mA745mQkQw7
... contents of private key ...
However I can't seem to figure out how to get OpenSSL to add such headers to the PEM file, I'm using the following OpenSSL version:
➜ ~ openssl version
LibreSSL 2.8.3
Am I' missing something obvious?, any help is really appreciated!
