Extract multiple keys from one .p12 file using OpenSSL ruby

C

2

7

I am wondering how to extract keys from an Apple .p12 file. From my limited understanding, a .p12 file is a combination of X504 certificates and private keys.

I am seeing that every .p12 file I run into has a X504 certificate and at least one key, and in some situations two keys. This is due to the fact that every .p12 has an Apple developer key, and some have an extra key (possibly an Apple root authorization key). I am considering only those .p12 files with two keys as valid. My goal here is to differentiate between those .p12 files that have one key and those that have two.

So far I have used OpenSSL to be able to inspect X504 files and the keys of any .p12. For example I have this code that does the inspections for all .p12 files in a directory:

Dir.glob('*.p12').each do |p|
  file = File.read(p)
  p12 = OpenSSL::PKCS12.new(file, "")

  # note that this new certificate is in an X509 format
  cert = p12.certificate
  puts p12.inspect()
  puts cert.inspect()
end

This is my output:

#<OpenSSL::PKCS12:0x007fcf33018920>
#<OpenSSL::X509::Certificate subject=/UID=FFBMT4K5/CN=iPhone Distribution: A.H. Belo Management Services, Inc./OU=FFBMT4K5/O=FFBMT4K5/C=US, issuer=/C=US/O=Apple Inc./OU=Apple Worldwide Developer Relations/CN=Apple Worldwide Developer Relations Certification Authority, serial=36597980220620, not_before=2012-01-11 16:30:22 UTC, not_after=2013-01-10 16:30:22 UTC>

Now my problem is getting keys. If I do something like this:

puts p12.key

I get a long string on encrypted data like this:

My question is how can I determine whether this certificate has more than one key, and also how I can inspect the keys for information. If what I am asking or my understanding of this issue is fundamentally flawed, please let me know. This is my first time being exposed to certificates and any information will be greatly helpful. Any points in the right direction will be appreciated, thanks in advance.

EDIT:

Using OpenSSL I can view the two shrouded keybags of a .p12. Example:

openssl pkcs12 -in some_p12.p12 -info -noout

output:

Enter Import Password:
MAC Iteration 1
MAC verified OK
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048
Certificate bag
Certificate bag
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048

So I'm looking for a couple things. Generally speaking, what exactly are these keybags? And also, how can I inspect them/determine how many I have per .p12 file using Ruby. Thanks.

Coumas answered 22/7, 2013 at 20:59 Comment(0)

B

0

I'm quite late for this one but it also interested me. I've tested creating a p12 file using two of my digital certificates (one expiring in 2023 and the other one in 2027) and this is was the openssl output:

$ openssl pkcs12 -in some_p12.p12 -info -noout

Enter Import Password:
MAC Iteration 1
MAC verified OK
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048
Certificate bag
Certificate bag
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048*

When parsing it in ruby using OpenSSL::PKCS12 I noticed one of the certificates could be read from the in ca_certs array and the other from the certificate method:

p12 = OpenSSL::PKCS12.new(file, "1234")
p12.certificate # => The latest one with the further expiry date (2027)
p12.key # => The private key from the certificate

p12.ca_certs # => Array, with the other certificate (expiring in 2023)
p12.ca_certs.count #=> 1

I could read the private key from the certificate using key as usual, however I could not find a way to read the key corresponding the certificate from ca_certs

Bregma answered 31/1, 2023 at 19:14 Comment(0)

S

-1

A .p12 contains only 1 private key, and contains 1 or more public keys. The public keys are the ones that make the chain of trust.

.p12 is a binary format. To convert it and extract to individual certificates, look for example here. The link contains all the openssl commands you need.

Steere answered 22/7, 2013 at 20:59 Comment(1)

I don't think this is correct. I now have a .p12 file and openssl shows 2 private keys. – Tadpole 25/3, 2019 at 17:13

Recommended topics

Hot tags