CertUtils: export private key to pem format correctly#2875
Conversation
This makes openssl rsa -in <file> -check pass, due to "RSA" string the validate of private key (pem file) by openssl fails. Also removes a commented import. Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
|
@blueorangutan package |
|
@rhtyd a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress. |
|
Packaging result: ✔centos6 ✔centos7 ✔debian. JID-2329 |
|
@blueorangutan test |
|
@rhtyd a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests |
GabrielBrascher
left a comment
There was a problem hiding this comment.
Thanks for the fix @rhtyd!
|
Trillian test result (tid-3056)
|
This makes openssl rsa -in -check pass, due to "RSA" string the
validate of private key (pem file) by openssl fails. Also removes
a commented import.
Without this fix, in some systems the key/crt could not be reused. Following error was observed in openssl:
$ openssl rsa -in -check
RSA key ok
139832889164824:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1220:
139832889164824:error:0D06C03A:asn1 encoding routines:ASN1_D2I_EX_PRIMITIVE:nested asn1 error:tasn_dec.c:788:
139832889164824:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:tasn_dec.c:720:Field=n, Type=RSA
139832889164824:error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib:rsa_ameth.c:121:
With this fix, the private key pem file will pass. Openssl output:
$ openssl rsa -in -check
RSA key ok
writing RSA key
-----BEGIN RSA PRIVATE KEY-----
...content of the file...
Types of changes
How Has This Been Tested?
More Found this issue while refactoring/fixing CCS with ACS 4.11.1. With the fix, kubernetes api service could use CA framework issued certificates.
Checklist:
Testing