p12 files don't show root and sub CA certificates

[Janpopan]

We use p12 keystores with root-CA certificate, sub-ca certificate and private key + public key - all in a chain

KSE 5.2 didn't show the ca certificates, only the keypair

KSE 5.1 shows only one of the ca-certificates (it is also a bug, but better than 5.2)

Th p12 file works well.

both certificates use the same entry or friendly name "CA certificates" maybe the problem?

Cheers Jan

[kaikramer]

First of all thanks for bug report, I appreciate this.

As this is going to be a lengthy answer with a lot of background info, I'll start with a short version: Double click on the key pair entry, the whole chain including the two CA certificates should appear there.

Now the long answer:

The difference between KSE 5.1.1 and 5.2 is that the older version used the PKCS#12 keystore implementation of the Bouncy Castle provider, whereas 5.2 now uses the implementation that is included in the Java runtime. I had to switch because of a few bugs that the Bouncy Castle guys were unwilling to fix because of compatibility reasons.

There exists a general problem when the extremely flexible PKCS#12 format is pushed into the keystore API. A PKCS#12 file basically consists of a bunch of so called "bags", which usually contain certificates or private keys. A Java keystore can contain any number of secret key entries, key pair entries (which must include the matching certificate and can include the whole chain) and trusted certificate entries. If a PKCS#12 file is opened in Java as a keystore, its content has to be somehow interpreted as one or more key pair and/or trusted certificate entries.

The standard PKCS#12 provider up to Java 7 did not allow trusted certificate entries at all. The JSSE Reference Guide says this:

Storing trusted certificates in a PKCS12 keystore is not supported. PKCS12 is mainly used to deliver private keys with the associated certificate chains. It does not have any notion of "trusted" certificates. In terms of interoperability, other PKCS12 vendors have the same restriction. Browsers such as Mozilla and Internet Explorer do not accept a PKCS12 file with only trusted certificates.

This has changed a bit in Java 8, which supports trusted certificates in PKCS#12 - if they are marked with a special attribute (OID 2.16.840.1.113894.746875.1.1):

openssl pkcs12 -in microsoft.p12 -info
MAC Iteration 1024
MAC verified OK
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 1024
Certificate bag
Bag Attributes
    friendlyName: microsoft it ssl sha2 (baltimore cybertrust root)
    2.16.840.1.113894.746875.1.1: <Unsupported tag 6>

So the reason why you don't see the CA certificates as separate entries is because they don't have this special attribute.

The good news is that this all probably doesn't matter in your case because those CA certificates belong to the chain of the private key entry. They are shown when you open the certificate details.

Trusted certificate entries are only important when you use the p12 file as a truststore.

[Janpopan]

Many thanks for explanation!

Double click works for us! :-)

Jan

[khmarochos]

I haven't found the way to do it with openssl, though I've found the way to do it with keytool (a part of OpenJDK suite).

I needed to create a keystore which would contain the CA certificate with the 2.16.840.1.113894.746875.1.1: <Unsupported tag 6> attribute and an additional certificate and its key without this attribute. I'd like to share the solution with other people who will find this page by googling openssl "2.16.840.1.113894.746875.1.1". Hello from 2021! =)

This command creates a PKCS12 with the CA certificate (assuming you already have a CA) which has 2.16.840.1.113894.746875.1.1: <Unsupported tag 6> attribute:

keytool -storepass '***' -import -alias ca -file ***/ca.crt.pem -keystore ***/ca.p12 -deststoretype PKCS12

This command converts the additional PEM-encoded certificate and its private key to PKCS12:

openssl pkcs12 -in ***/additional.cert.pem -inkey ***/additional.key.pem -name additional -export -out ***/additional.p12

This command merges the PKCS12 keystore containing the CA certificate to the PKCS12 keystore containing the additional and its private key:

keytool -importkeystore -srckeystore ***/ca.p12 -srcstoretype pkcs12 -srcstorepass '***' -destkeystore ***/additional.p12 -deststoretype pkcs12 -deststorepass '***'