Task to export key using option to encrypt with a password fails: Export failed with error: System.IO.IOException: PKCS12 key store MAC invalid - wrong password or corrupted file.

[elkinweta]

Using Certify The Web Hub v7.1.1.0 on Windows Server 2016 Essentials:

I have a renewed certificate. I created a task to export the private key to a .pem file.

When I do not use the option under Certificate > Advanced > Signing & Security > Security: "You can optionally specify a password credential to use for private keys and PFX files generated for this certificate", the task runs successfully and the key is exported.

When I store a password (Settings > Stored Credentials > Add Stored Credential > type = password) and then change the above option to use that stored password credential to encrypt the private key, then when I run the task it fails with this error:

Export failed with error: System.IO.IOException: PKCS12 key store MAC invalid - wrong password or corrupted file.
   at Org.BouncyCastle.Pkcs.Pkcs12Store.Load(Stream input, Char[] password)
   at Certify.Shared.Core.Utils.PKI.CertUtils.GetCertKeyPem(Byte[] pfxData, String pwd) in D:\a\certify-internal\certify-internal\src\certify-build\certify\src\Certify.Shared\Utils\PKI\CertUtils.cs:line 296
   at Certify.Shared.Core.Utils.PKI.CertUtils.GetCertComponentsAsPEMString(Byte[] pfxData, String pwd, ExportFlags flags, Boolean strictExport) in D:\a\certify-internal\certify-internal\src\certify-build\certify\src\Certify.Shared\Utils\PKI\CertUtils.cs:line 81
   at Certify.Shared.Core.Utils.PKI.CertUtils.GetCertComponentsAsPEMBytes(Byte[] pfxData, String pwd, ExportFlags flags, Boolean strictExport) in D:\a\certify-internal\certify-internal\src\certify-build\certify\src\Certify.Shared\Utils\PKI\CertUtils.cs:line 47
   at Certify.Providers.DeploymentTasks.CertificateExport.Execute(DeploymentTaskExecutionParams execParams, String specificPath, String specificType) in D:\a\certify-internal\certify-internal\src\certify-build\certify-plugins\src\DeploymentTasks\Core\Providers\CertificateExport.cs:line 193

I think I had used this successfully in the past, but I'm not sure. I observed it in version 7.1.0.0 and also after upgrading to 7.1.1.0.

I have deleted the stored password, created a new one, and tried turning the setting off and on multiple times. The error is consistent and 100% reproducible when the setting to encrypt the key with (any) stored password is enabled.

[webprofusion-chrisc]

I think the problem here is that you've set a password but you have not yet requested a cert that will apply that password, so the PFX on disk has no password and trying to use a password to export it results in the error.

We should perhaps catch that and try an export with blank password but that would be hiding the issue a little. The fix is to set your preferred PFX password, Request Certificate (so that the PFX gets rebuilt), then run your task.

[elkinweta]

@webprofusion-chrisc , thanks for the quick reply and you're correct! I confirmed it worked after I renewed the certificate (after the password setting had already been set).

I didn't know that password setting was applicable to how CTW stores the private key internally; the language used in the UI ("You can optionally specify a password credential to use for private keys and PFX files generated for this certificate") implies that it only applies to whether or not a password is applied when exporting (generating) files.

In any case, if a user follows the flow that I did, may I suggest this improved application behavior:

• If the certificate was requested/generated with no password applied and then the password setting is changed to enabled, then either

  • export the certificate with no password (if you don't view this as a security risk), or
  • regenerate the files with the newly specified password before exporting.
    (I don't know what libraries you're using, but openssl can do this, e.g.: openssl pkcs8 -in unencrypted-private-key.pem -topk8 -v2 aes-256-cbc -out encrypted-private-key.pem ), or
  • show an improved error like the one described below.

• If the certificate was requested/generated with a password applied and then the password setting is changed to disabled or the password was changed or deleted, then show an error:

"The password used to encrypt private keys and pfx files was changed or deleted, or the setting (Certificate > Advanced > Signing & Security > Security: "You can optionally specify a password credential to use for private keys and PFX files generated for this certificate") was disabled, after this certificate was requested. You must request a new certificate, which can then be exported using the current settings.