Encrypted private key in client-side certificate.

[nikomi]

Hi,

I have a request - more like a wish - for client-side certificate handling:

We have a certificate with encrypted private key and therefore need to pass the password for the private key to the certificate loader function. Afaik neither credentialLoadX509 nor credentialLoadX509FromMemory support this.

Would it be possible to add this functionality? Or is there known work-around?

thanx, nikomi

[vincenthz]

I'ld like that too, but I don't see how to provide a user experience for this. I'm not sure what other applications that supports directly encrypted keys do TBH.

[nikomi]

The HsOpenSSL package - more or less a wrapper around low-level OpenSSL calls - uses a data type called PemPasswordSupply that can represent no pwd, a pwd String, or a callback obtaining the pwd - see http://hackage.haskell.org/package/HsOpenSSL-0.11.1.1/docs/OpenSSL-PEM.html.

This method appears reasonably flexible, what do you think?