Rewrite test certificates using more modern algorithms #661
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The test.p12 file use the RC2-CBC and 3DES-CBC algorithms, which are quite dated and require the `-legacy` option in openssl to read them. ```console $ openssl pkcs12 -in test.p12 -info -noout -legacy -passin pass:test MAC: sha1, Iteration 1 MAC length: 20, salt length: 8 PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048 Certificate bag PKCS7 Data Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048 ``` Rewrite the test.p12 file with a current openssl (via p12 -> pem -> p12 conversion) to use more modern algorithms which do not require legacy mode. Rewrite test.pem with a new export of test.p12. ```console $ openssl pkcs12 -in test.p12 -info -noout -passin pass:test MAC: sha256, Iteration 2048 MAC length: 32, salt length: 8 PKCS7 Encrypted data: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA256 Certificate bag PKCS7 Data Shrouded Keybag: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA256 ```
|
This PR appears to have caused the macOS command |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I tried to read the test certificate with openssl 3.0.7, which initially failed. I'm not an expert in openssl and pkcs12, but I think this solves the issue. Please review and run the unit tests.
Description
The test.p12 file use the RC2-CBC and 3DES-CBC algorithms, which are quite dated and require the
-legacyoption in openssl to read them.Rewrite the test.p12 file with a current openssl (via p12 -> pem -> p12 conversion) to use more modern algorithms which do not require legacy mode. Rewrite test.pem with a new export of test.p12.