Mac verify error: invalid password

[dev-guidolin]

I can't generate a certificate.

Error:
Process runtime error, reason: "Mac verify error: invalid password?. "

ManagerCert.php:
line 104
$openssl = "openssl pkcs12 -in {$pfxPath} -out {$output} -nodes -password pass:{$this->password}";

result:
openssl pkcs12 -in /var/www/digital/digital/storage/app/certificado/certificado.pfx -out /var/www/digital/digital/app/LSNepomuceno/LaravelA1PdfSign/Temp/96f30689-040a-47e0-a7e3-f43d334e2f3d.crt -nodes -password pass:***

A file has been created in /temp/ but empty file.

Any Idea?

[lsnepomuceno]

Hello @dev-guidolin,

First we would like to thank you for using our package.

Let's get to the problem...

The reported error is generated by OpenSSL when the private password is not compatible with the given certificate.

If possible, validate the use of the certificate with the correct password in another application.

If the password is indeed correct, please let me know which version of Laravel and Package you are using.

It is worth emphasizing that for users in Brazil, it is interesting that the certificate complies with the ICP-Brasil, as this will guarantee data standardization.

[dev-guidolin]

Hi Lucas, thanks a lot to reply my question.
Answer yours questions:
Laravel latest version: 9x

The password works when i open the certificate or use this:
$content = Storage::disk('local')->get($certificado->path_to_certificate);
$password= ***;
$certs = [];
openssl_pkcs12_read($content, $certs, $password);

This give me all information about certificate.

In this library, I can read the certificate.pfx normally.
https://github.com/nfephp-org/sped-common/blob/master/src/Certificate.php#L59

[lsnepomuceno]

The detail of the problem is precisely the method openssl_pkcs12_read(), currently the signature package by A1 only accepts certificates with x509 encryption.

But this could be an opportunity for us to implement this new functionality.

Could you send us a PKCS12 certificate to start testing and implementing?

If possible, just send me via email: lsn.nepomuceno@gmail.com

[dev-guidolin]

Lucas, I sent by email. :)

[lsnepomuceno]

Hello,

As previously described, the package currently only supports x509-encrypted certificates.

To use PKCS12 certificates it would be necessary to test with a real file accompanied by the access password.

If you are interested, just send me a certificate with the password by email, I will be happy to help.