45

There seem to exist still some tools which generate private keys encrypted with RC2-40-CBC

Although I'm able to export it to a new key store using keytool -importkeystore it seems that I can't get rid of this algorithm.

How to convert them to PEM ?

OpenSSL fails with:

digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:349:Global default library context, Algorithm (RC2-40-CBC : 0), Properties ()

2 Answers 2

92

openssl has a key algorithm provider called legacy. Just try with:

openssl pkcs12 -in mycert.p12 -legacy -nodes
2
  • 1
    this produces invalid key
    – softcode
    Commented Aug 28, 2023 at 14:27
  • 1
    This is a working solution. From a valid PKCS#12 file it will produce an intact key. Commented Oct 4, 2023 at 17:21
7

You can change it permamently in OpenSSL configuration. Just modify file /etc/ssl/openssl.cnf

Find the [default_sect] section and change it to:

[default_sect]
activate = 1
[legacy_sect]
activate = 1

Then find the [provider_sect] and use:

[provider_sect]
default = default_sect
legacy = legacy_sect

Save file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.