<html><head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head><body text="#000000" bgcolor="#FFFFFF">Hi Toby,<br>
<br>
<pre wrap="">>> the question remains: Is there a way to reuse an already-encrypted privkey?</pre>
I'd say yes it *could* work, but not with OpenSSL API functions. You'd
have to roll your own code for the PKCS12 creation.<br>
<br>
OpenSSL's PKCS12_create() function expects an unencrypted EVP_PKEY
object. But, internally, that key is turned into a encrypted PKCS8
structure, as expected by the PKCS8ShroudedKeyBag type defined in
RFC-7292.<br>
<br>
Thats why I think it may be possible to experiment and modify code such
as in crypto/pkcs12/p12_crt.c, trying to pass-through that already
encrypted PKCS8 key "as-is" straight into the pkcs8ShroudedKeyBag
object. If your key is a file in PEM format, you'd need to get that into
an internal structure first (more coding), I don't think there is a
simple API import (without decryption).<br>
<br>
<span>If you manage to successfully built that PKCS12, you'd run into
trouble for decoding, which probably fails for all known software. They
all expect to be able to read the private key, when in your case it
needs saving </span>to a file somewhere for further handling, or for
entering that second key-specific password. You'd again have to code
your own PKCS12 unpack program, just for this specific use case.<br>
<br>
I may be wrong but to me it looks doable, just a *lot* of work.<br>
<br>
Frank<br>
<blockquote style="border: 0px none;"
cite="mid:20180220121540.GB8389@kit.edu" type="cite">
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="width:100%;border-top:2px solid #EDF1F4;padding-top:10px;"> <div
style="display:inline-block;white-space:nowrap;vertical-align:middle;width:49%;">
<a moz-do-not-send="true" href="mailto:tobias.dussa@kit.edu"
style="color:#485664
!important;padding-right:6px;font-weight:500;text-decoration:none
!important;">Tobias Dussa (SCC)</a></div> <div
style="display:inline-block;white-space:nowrap;vertical-align:middle;width:48%;text-align:
right;"> <font color="#909AA4"><span style="padding-left:6px">Tuesday,
February 20, 2018 9:15 PM</span></font></div> </div></div>
<div style="color:#909AA4;margin-left:24px;margin-right:24px;"
__pbrmquotes="true" class="__pbConvBody"><pre wrap="">Hi,
On Tue, Feb 20, 2018 at 12:23:14PM +0100, Jakob Bohm wrote:
</pre><blockquote type="cite"><blockquote type="cite"><pre wrap="">Googling does not reveal much useful information, unfortunately, and so far we
have been unsuccessfully diving into PKCS12/8/5 specs. I don't really see a
reason why it should not be possible, but of course that doesn't mean it is. :)
</pre></blockquote><pre wrap="">In the commonly accepted variants of PKCS#12, private key and all the
certificates are encrypted with the same password. PKCS#12 with
different password for private key and certificates is not widely
supported.
</pre></blockquote><pre wrap=""><!---->
I see.
</pre><blockquote type="cite"><pre wrap="">In the concatenated PEM format, only the private key is encrypted, but
not the certificates.
</pre></blockquote><pre wrap=""><!---->
Yep.
</pre><blockquote type="cite"><pre wrap="">So to convert from concatenated PEM format to PKCS#12, even if the
encrypted private key could be kept without decrypting the private
key, the password for the private key is still needed to encrypt
the certificates with the same password.
</pre></blockquote><pre wrap=""><!---->
... iff you need to retain wide-spread compatibility. So if that is not
necessary, the question remains: Is there a way to reuse an already-encrypted
privkey?
THX & Cheers,
Toby.
</pre></div>
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="width:100%;border-top:2px solid #EDF1F4;padding-top:10px;"> <div
style="display:inline-block;white-space:nowrap;vertical-align:middle;width:49%;">
<a moz-do-not-send="true" href="mailto:jb-openssl@wisemo.com"
style="color:#485664
!important;padding-right:6px;font-weight:500;text-decoration:none
!important;">Jakob Bohm</a></div> <div
style="display:inline-block;white-space:nowrap;vertical-align:middle;width:48%;text-align:
right;"> <font color="#909AA4"><span style="padding-left:6px">Tuesday,
February 20, 2018 8:23 PM</span></font></div> </div></div>
<div style="color:#909AA4;margin-left:24px;margin-right:24px;"
__pbrmquotes="true" class="__pbConvBody"><br>In the commonly accepted
variants of PKCS#12, private key and all the
<br>certificates are encrypted with the same password. PKCS#12 with
<br>different password for private key and certificates is not widely
<br>supported.
<br>
<br>In the concatenated PEM format, only the private key is encrypted,
but
<br>not the certificates.
<br>
<br>So to convert from concatenated PEM format to PKCS#12, even if the
<br>encrypted private key could be kept without decrypting the private
<br>key, the password for the private key is still needed to encrypt
<br>the certificates with the same password.
<br>
<br>
<br>Enjoy
<br>
<br>Jakob
<br></div>
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="width:100%;border-top:2px solid #EDF1F4;padding-top:10px;"> <div
style="display:inline-block;white-space:nowrap;vertical-align:middle;width:49%;">
<a moz-do-not-send="true" href="mailto:tobias.dussa@kit.edu"
style="color:#485664
!important;padding-right:6px;font-weight:500;text-decoration:none
!important;">Tobias Dussa (SCC)</a></div> <div
style="display:inline-block;white-space:nowrap;vertical-align:middle;width:48%;text-align:
right;"> <font color="#909AA4"><span style="padding-left:6px">Tuesday,
February 20, 2018 7:04 PM</span></font></div> </div></div>
<div style="color:#909AA4;margin-left:24px;margin-right:24px;"
__pbrmquotes="true" class="__pbConvBody"><div>Hi,<br><br>I was wondering
whether it was possible somehow to take a certificate and an<br>enciphered
private key, both in .pem format, and combine them into a PKCS12<br>structure
without knowing the key passphrase?<br><br>Googling does not reveal
much useful information, unfortunately, and so far we<br>have been
unsuccessfully diving into PKCS12/8/5 specs. I don't really see a<br>reason
why it should not be possible, but of course that doesn't mean it is.
:)<br><br>THX & Cheers,<br>Toby.<br></div></div>
</blockquote>
<br>
</body></html>