OpenSSL::PKCS12 error: PKCS12_parse: unsupported

[marcosdemelo]

OpenSSL::PKCS12 error: PKCS12_parse: unsupported

[rhenium]

$ openssl asn1parse -inform DER -offset 30 -in expired-certificate.pfx
    0:d=0  hl=4 l=1712 cons: SEQUENCE
    4:d=1  hl=4 l= 943 cons: SEQUENCE
    8:d=2  hl=2 l=   9 prim: OBJECT            :pkcs7-encryptedData
   19:d=2  hl=4 l= 928 cons: cont [ 0 ]
   23:d=3  hl=4 l= 924 cons: SEQUENCE
   27:d=4  hl=2 l=   1 prim: INTEGER           :00
   30:d=4  hl=4 l= 917 cons: SEQUENCE
   34:d=5  hl=2 l=   9 prim: OBJECT            :pkcs7-data
   45:d=5  hl=2 l=  28 cons: SEQUENCE
   47:d=6  hl=2 l=  10 prim: OBJECT            :pbeWithSHA1And40BitRC2-CBC
   59:d=6  hl=2 l=  14 cons: SEQUENCE
   61:d=7  hl=2 l=   8 prim: OCTET STRING      [HEX DUMP]:9EA1631619B43919
   71:d=7  hl=2 l=   2 prim: INTEGER           :0800
   75:d=5  hl=4 l= 872 prim: cont [ 0 ]
  951:d=1  hl=4 l= 761 cons: SEQUENCE
  955:d=2  hl=2 l=   9 prim: OBJECT            :pkcs7-data
  966:d=2  hl=4 l= 746 cons: cont [ 0 ]
[...]

:pbeWithSHA1And40BitRC2-CBC

This is the problem (cf. #500). RC2 belongs to the legacy provider in OpenSSL >= 3.0, which is not enabled by default. openssl pkcs12 will also refuse to load this file without the -provider default -provider legacy options.

#635 will allow loading providers explicitly with:

OpenSSL::Provider.load("default")
OpenSSL::Provider.load("legacy")

certificate = OpenSSL::PKCS12.new(file, '123456')
[...]

[marcosdemelo]

On Ruby 3.2.2 the error persists...

=> (irb):3:in `initialize': PKCS12_parse: unsupported (OpenSSL::PKCS12::PKCS12Error)

[dtonon]

I have the same problem:

rails c
Loading development environment (Rails 7.0.4.2)
irb(main):001:0> require 'openssl'
=> false
irb(main):002:0> OpenSSL::OPENSSL_LIBRARY_VERSION
=> "OpenSSL 3.1.0 14 Mar 2023"
irb(main):003:0> OpenSSL::OPENSSL_VERSION
=> "OpenSSL 3.1.0 14 Mar 2023"
irb(main):004:0> OpenSSL::VERSION
=> "3.1.0"
irb(main):005:0> RUBY_VERSION
=> "3.2.1"
irb(main):007:0> key = OpenSSL::PKCS12::new( File.read("#{Rails.root}/config/xxxxxxxxx.p12"), '123456' ).key
(irb):7:in `initialize': PKCS12_parse: unsupported (OpenSSL::PKCS12::PKCS12Error)
irb(main):008:0> OpenSSL::Provider.load("default")
(irb):8:in `<main>': uninitialized constant OpenSSL::Provider (NameError)

I tried to vendorize the last github version too, same problem.
Any help, please?

[abiagini]

@dtonon is not released yet, the last realease was on december 22.
You should go with the approach of #635