Getting OpenSSL::X509::CertificateError nested asn1 error on Ruby

Question

I have .p12 file from Apple and tried to convert it to .pem file with following command:

openssl pkcs12 -in cert.p12 -out apple_push_notification_development.pem -nodes -clcerts

When trying the create new OpenSSL::X509::Certificate object with

OpenSSL::X509::Certificate.new(File.read('apple_push_notification_development.pem'))

I get the following error:

OpenSSL::X509::CertificateError: nested asn1 error
    from (irb):9:in `initialize'
    from (irb):9:in `new'
    ...

Did I do something wrong ? Being stuck, please help. Thanks

score 16 · Answer 1 · answered Nov 08 '14 at 17:17

Appreciate it's not your exact same scenario, but I was attempting to read in a PEM file (PKCS7) in my instance. OpenSSL CLI would decode it fine, but ruby kept throwing the same nested asn1 error that you describe when I tried to load it into an object.

In my case it needed a new line i.e. '\n' at the end of the PEM file for it to accept it.

I worked it out only when I created an empty object and compared the generated PEM output to the file I was trying to load.

So with a X509 cert maybe try:

cert = OpenSSL::X509::Certificate.new
cert.to_pem
=> "-----BEGIN CERTIFICATE-----\nMCUwGwIAMAMGAQAwADAEHwAfADAAMAgwAwYBAAMBADADBgEAAwEA\n-----END CERTIFICATE-----\n"

And compare it to your PEM file

As you can see it's terminated with a new line and that was missing in the file that I was trying to import.

For me it was that I had not included the '\n's in the end and after each block. Once my string looked like yours, it worked. — Jeremie Weldin, Aug 01 '18 at 19:46
Thanks! Exact same issue .. had to explicitly add \n after BEGIN block and surrounding the END block. — Petrus Repo, Aug 25 '21 at 08:23

score 12 · Answer 2 · answered Mar 17 '15 at 15:31

I've had the same problem and im my case I needed to decode file content with Base64.

require 'openssl'
require 'base64'

encoded_content = File.read('apple_push_notification_development.pem')
decoded_content = Base64.decode64(encoded_content)
certificate = OpenSSL::X509::Certificate.new(decoded_content)

score 7 · Answer 3 · answered Jun 05 '15 at 10:17

This also may happen when you forget to sign newly generated certificate. I wanted to use self-signed certificate but forgot signing part.

# Create key
key = OpenSSL::PKey::RSA.new(2048)
open("key.pem", "w") do |io| io.write(key.to_pem) end

# Generate certificate
name = OpenSSL::X509::Name.parse("CN=example.com/C=EE")
cert = OpenSSL::X509::Certificate.new
cert.version     = 2
cert.serial      = 0
cert.not_before  = Time.now
cert.not_after   = cert.not_before + 1 * 365 * 24 * 60 * 60 # 1 year validity
cert.public_key  = key.public_key
cert.subject     = name

and this part of code is what I missed:

cert.issuer = name
cert.sign key, OpenSSL::Digest::SHA1.new
open "cert.pem", 'w' do |io| io.write cert.to_pem end

Getting OpenSSL::X509::CertificateError nested asn1 error on Ruby

3 Answers3

Linked