Can't import p12 certificate

[GreamDesu]

Checked three times, when I've generated my client certificate I typed my password, but when I try to import it to certificate store it says that password is incorect, however I checked it.
OS: Win 10

[hwdsl2]

@GreamDesu Hello! Cannot reproduce this issue on a Windows 10 system. This is usually caused by incorrectly typing it or copy paste errors (extra space, etc.) Try regenerate the client certificate .p12 file with a different password and import again.

[GreamDesu]

@hwdsl2 tried it three times with different passwords even with empty password, but still it says that password is incorrect

[hwdsl2]

@GreamDesu What is your Windows 10 version (e.g. 1803) and what is your server’s Linux distribution and version (e.g. Ubuntu 16.04)?

[GreamDesu]

@hwdsl2 Windows 10 1803, Ubuntu 18.04

[NUWebStudio]

Hi, How did you resolve this issue I seem to have exact same issue wont import via mmc.exe on windows 10 says password is incorrect even when i set it to something simple like 1234. Error logs on windows machine show this:
"PFX operation failed as Iteration count doesn't lie in expected range. Maximum permissible value: 600000. Erroneous value: 1000000."

When I run pk12util -l vpnclient.p12 on VPS it asks for password and shows the p12 contents so I know its being exported and read okay by VPS. Although this seems like a limitation on windows 10 as the Iteration count is above 600000.

[hwdsl2]

@NUWebStudio Hello! This is due to a bug in NSS [1] [2]. If your server runs CentOS/RHEL, use yum to update the nss package to the latest version, then re-export the .p12 file. From the changelog:

... ...
* Tue Mar 27 2018 Daiki Ueno <dueno@redhat.com> - 3.36.0-3
- Decrease the iteration count of PKCS#12 for compatibility with Windows
- Fix deadlock when a token is re-inserted while a client process is running
... ...

If using Ubuntu 18.04, there is currently no easy workaround until a fixed version of the libnss3 package [3] is available.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1559989
[2] https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.1_release_notes#Notable_Changes_in_NSS_3.36.1
[3] https://packages.ubuntu.com/search?keywords=libnss3&searchon=names

[NUWebStudio]

Thanks that makes sense, Im using Ubuntu 18.04 so will take a look at 3.

Cheers

[lovedva]

@NUWebStudio Hello! This is due to a bug in NSS [1] [2]. If your server runs CentOS/RHEL, use yum to update the nss package to the latest version, then re-export the .p12 file. From the changelog:

... ...
* Tue Mar 27 2018 Daiki Ueno <dueno@redhat.com> - 3.36.0-3
- Decrease the iteration count of PKCS#12 for compatibility with Windows
- Fix deadlock when a token is re-inserted while a client process is running
... ...

If using Ubuntu 18.04, there is currently no easy workaround until a fixed version of the libnss3 package [3] is available.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1559989 [2] https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.1_release_notes#Notable_Changes_in_NSS_3.36.1 [3] https://packages.ubuntu.com/search?keywords=libnss3&searchon=names

佛了还没更新。。。我决定换个Ubuntu版本了。。。