0

I have some strange error which I can't figure out, despite hours of searching on Google and stack overflow.

I have a PKCS12 file (.p12) which I generated myself using OpenSSL on the command line. This seems to be fine. However, when trying to retrieve the private key of this .p12 keystore, I get the complete file in return instead of just the private key.

The .p12 file has been created as follows:

openssl ecparam -genkey -name secp256r1 | openssl ec -out privateKeys/contractCert.key -aes128 -passout file:passphrase.txt
openssl req -new -key privateKeys/contractCert.key -passin file:passphrase.txt -config configs/contractCert.cnf -extensions ext -out csrs/contractCert.csr
openssl x509 -req -in csrs/contractCert.csr -extfile configs/contractCert.cnf -extensions ext -CA certs/moSub2CA.pem -CAkey privateKeys/moSub2CA.key -set_serial 12 -passin file:passphrase.txt -days 730 -out certs/contractCert.pem
cat certs/oemSub1CA.pem certs/oemSub2CA.pem > certs/intermediateMOCAs.pem
openssl pkcs12 -export -inkey privateKeys/contractCert.key -in certs/contractCert.pem -certfile certs/intermediateMOCAs.pem -aes128 -passin file:passphrase.txt -passout file:passphrase2.txt -name contract_cert -out certs/contractCert.p12

When printing the .p12 on the terminal, I get this output.

The Java code to retrieve the key goes as follows

public static PrivateKey getPrivateKeyFromPKCS12(String pkcs12Resource) {
    PrivateKey privateKey = null;
    KeyStore contractCertificateKeystore = getPKCS12KeyStore(SecurityUtils.class.getResource(pkcs12Resource).getFile(), GlobalValues.PASSPHRASE_FOR_CERTIFICATES_AND_KEYS.toString());

    try {
        PrivateKey privateContractCertKey = (PrivateKey) contractCertificateKeystore.getKey("contract_cert", GlobalValues.PASSPHRASE_FOR_CERTIFICATES_AND_KEYS.toString().toCharArray());
        System.out.println("\nprivateContractCertKey key of " + privateContractCertKey.getEncoded().length + " bytes: " + ByteUtils.toHexString(privateContractCertKey.getEncoded()));
    } catch (KeyStoreException | UnrecoverableKeyException | NoSuchAlgorithmException e) {
        getLogger().error("The private key from PKCS12 file at resource '" + pkcs12Resource + 
                          "' could not be retrieved (" + e.getClass().getSimpleName() + ")", e);
    }
    return privateKey;
}

When I run this code I get

privateContractCertKey key of 138 bytes: 308187020100301306072A8648CE3D020106082A8648CE3D030107046D306B020101042060F7588AA9F63ABB56F215563A387E1694F076DD4EA10D8399C67B5085C58C9CA14403420004F356E2BE57AE7D451449BC5C60D40E84994E49ACC21B5C052671DA8173C085A8CBFF07B33FADF30E52C42FBC1261FB6BC873C2F56AA96BEE331E603DB1C31669

As one can see, the private key 60F7588AA9F63ABB56F215563A387E1694F076DD4EA10D8399C67B5085C58C9C is included there as well as the public key 04F356E2BE57AE7D451449BC5C60D40E84994E49ACC21B5C052671DA8173C085A8CBFF07B33FADF30E52C42FBC1261FB6BC873C2F56AA96BEE331E603DB1C31669.

I just don't get it. How am I supposed to get exactly the private key with Java methods?

Marc
  • 147
  • 1
  • 2
  • 10
  • never mind the cut&paste error in the openSSL statements: cat certs/oemSub1CA.pem certs/oemSub2CA.pem > certs/intermediateMOCAs.pem should be cat certs/moSub1CA.pem certs/moSub2CA.pem > certs/intermediateMOCAs.pem – Marc Mar 25 '15 at 17:22
  • Further information: the answer from ["Getting a PrivateKey object from a .p12 file in Java"](http://stackoverflow.com/questions/18621508/getting-a-privatekey-object-from-a-p12-file-in-java) does not seem to be completely correct. When calling `.getFormat()`on the retrieved Key object, I get "PKCS#8". However, as stated in [RFC 5208 "PKCS #8: Private-Key Information Syntax Standard"](http://www.ietf.org/rfc/rfc5208.txt) section 5, there is no public key field, just _version, privateKeyAlgorithm, privateKey_ and _attributes_ – Marc Mar 25 '15 at 18:03

0 Answers0