On Wed, Mar 17, 2010, Mark Spruiell wrote:
> Using OpenSSL 1.0b5, I generated a self-signed CA certificate and then
> created a key pair using commands like this:
>
> openssl req -config ssl.cnf -newkey rsa:1024 -passout pass:password \
> -keyout key.pem -keyform PEM -out tmp/req.pem
> openssl ca -config ssl.cnf -batch -in tmp/req.pem -out cert.pem \
> -cert cacert.pem -keyfile cakey.pem
>
> When I try to load this key pair in a program built with OpenSSL 0.9.8m,
> the call to SSL_CTX_use_PrivateKey_file fails with the following
> error output:
>
> 6158:error:06074079:digital envelope
> routines:EVP_PBE_CipherInit:unknown pbe
> algorithm:evp_pbe.c:89:TYPE=PBES2
> 6158:error:23077073:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 algor
> cipherinit error:p12_decr.c:83:
> 6158:error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe
> crypt error:p12_decr.c:123:
> 6158:error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1
> lib:pem_pkey.c:125:
> 6158:error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM
> lib:ssl_rsa.c:669:
>
> This error occurs regardless of whether I enter the correct password.
> If I generate the key pair without password-protecting the key, the
> program can load the key successfully.
>
> I understand that OpenSSL 1.0 uses a different format for storing
> private keys, but shouldn't earlier versions of OpenSSL still be able
> to use such a key file?
>
> Both OpenSSL 0.9.8m and 1.0b5 were compiled from source on
> SLES 11 as follows:
>
> ./config threads shared --prefix=...
>
> Here's the test program:
>
> #include <stdio.h>
> #include <openssl/err.h>
> #include <openssl/ssl.h>
>
> void handleError(const char* msg)
> {
> int reason = ERR_GET_REASON(ERR_peek_error());
> fprintf(stderr, "%s: reason = %d\n", msg, reason);
> ERR_print_errors_fp(stderr);
> exit(1);
> }
>
> int main(int argc, char **argv)
> {
> SSL_CTX* ctx;
>
> if(!SSL_library_init())
> {
> fprintf(stderr, "init failure\n");
> return 1;
> }
> SSL_load_error_strings();
>
> ctx = SSL_CTX_new(SSLv23_method());
> if(SSL_CTX_use_certificate_chain_file(ctx, "cert.pem") != 1)
> {
> handleError("error loading certificate");
> }
> if(SSL_CTX_use_PrivateKey_file(ctx, "key.pem", SSL_FILETYPE_PEM) != 1)
> {
> handleError("error loading key");
> }
>
> printf("Done\n");
> SSL_CTX_free(ctx);
>
> return 0;
> }
Try including OpenSSL_add_all_algorithms() as well.
Steve.
--
Dr Stephen N. Henson. OpenSSL project core developer.
Commercial tech support now available see: http://www.openssl.org
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [email protected]
