Skip to content

Error converting PKCS#12 archive file to PEM blocks: pkcs12: unknown digest algorithm: 2.16.840.1.101.3.4.2.1 #272

@Sparc0

Description

@Sparc0

PROBLEM SUMMARY
Unable to use vcert getcred to generate new token.
My new p12 file was generated using java keytool and i guess vcert does not know how to handle it based on the error i get.
My old p12 file was generated on Windows.
I can use CURL to request a token using the same p12 file so my file is not the problem.

STEPS TO REPRODUCE
How i generated my p12 file.

keytool -genkey \
-alias cba_cert \
-validity 180 \
-keyalg RSA \
-keysize 2048 \
-keystore certfile.pfx \
-dname "REDACTED"

I then had the certificate signed by our CLM instance and imported it back into the file.

./vcert getcred -u https://clm-api.com --p12-file certfile.pfx --p12-password secret --client-id MyID --scope "certificate:manage" --format json
Error converting PKCS#12 archive file to PEM blocks: pkcs12: unknown digest algorithm: 2.16.840.1.101.3.4.2.1
EXPECTED RESULTS

{
  "access_token": "REDACTED==",
  "expires_in": 1296000,
  "expires": 1672933356,
  "token_type": "Bearer",
  "scope": "certificate:manage",
  "identity": "local:{REDACTED}",
  "refresh_until": 1672933356
}

ACTUAL RESULTS
Error converting PKCS#12 archive file to PEM blocks: pkcs12: unknown digest algorithm: 2.16.840.1.101.3.4.2.1

ENVIRONMENT DETAILS
Tried vcert version v4.23.0 & v4.20.0 same error.

java --version 
openjdk 11.0.17 2022-10-18 LTS

OpenSSL info of my old and new p12 file.
Old

openssl pkcs12 -info -in old.pfx -noout 
Enter Import Password:
MAC Iteration 2000
MAC verified OK
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2000
PKCS7 Data
Certificate bag
Certificate bag
Certificate bag

New

openssl pkcs12 -info -in certfile.pfx -noout
Enter Import Password:
MAC Iteration 10000
MAC verified OK
PKCS7 Data
Shrouded Keybag: PBES2, PBKDF2, AES-256-CBC, Iteration 10000, PRF hmacWithSHA256
PKCS7 Encrypted data: PBES2, PBKDF2, AES-256-CBC, Iteration 10000, PRF hmacWithSHA256
Certificate bag
Certificate bag
Certificate bag

COMMENTS/WORKAROUNDS
Generate a token using the same p12 file but with CURL works.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workinginvestigatingResearch is needed

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions