Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use legacy OpenSSL Format for Apple Devices #14718

Merged
merged 2 commits into from May 10, 2024

Conversation

vvorlov
Copy link
Contributor

@vvorlov vvorlov commented May 6, 2024

Description

Uses legacy key format to generate .p12 and .mobileprovision files.

Motivation and Context

openssl@3 uses a modern private key format unsupported on Apple devices because Apple has not updated its libraries. Importing generated .p12 files into the modern macOS and iOS keychain leads to the wrong password error. If you try to export a private key from .p12 and import it into Keychain separately, it will show the wrong format error.

Closes #14558

Based on #14622 with applied comments.

How Has This Been Tested?

  1. Amazon Lighstail
  2. Cloned repo and installed via METHOD=local ENDPOINT=<ip_adderess> USERS=hello,world ./install.sh. I had to modify the install script to point to the fork on the getAlgo step
  3. Downloaded .mobileprovision files
  4. Installed on macOS 14.4.1 (23E224)
  5. Connected to the server.
  6. Installed on iOS 17.4.
  7. Connected to the server.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist:

  • I have read the CONTRIBUTING document.
  • My code follows the code style of this project.
  • [] My change requires a change to the documentation.
  • [] I have updated the documentation accordingly.
  • [] I have added tests to cover my changes.
  • [] All new and existing tests passed.

@vvorlov vvorlov requested a review from jackivanov as a code owner May 6, 2024 01:09
@vvorlov vvorlov changed the title Use legacy OpenSSL Format on Apple Devices Use legacy OpenSSL Format for Apple Devices May 6, 2024
roles/strongswan/tasks/openssl.yml Outdated Show resolved Hide resolved
@jackivanov jackivanov merged commit 8c4ae50 into trailofbits:master May 10, 2024
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

iPhone: "Profile Installation Failed" - The password for the certificate "phone.p12" is incorrect.
2 participants