PKCS5 error (version 1.2.9)

[Matteo13]

I’m trying to setup a server with ECDSA/ECDHE. I can easily connect from the app but only if the key is unencrypted.

If the key is encrypted then I get the PKCS5 error after entering the password in the prompt.

I used to solve this by re-encrypting the key with openssl (I changed rsa with ec), then pasting the key back in the .ovpn file. This doesn’t seem to work with EC keys, instead I’m getting a “Bad private key password” error, with no password prompt.

Code: Select all

openssl ec -in private.key -aes256 -out private2.key

This morning I updated the app to version 1.2.9 but it’s still not working for me. I bet I’m doing something wrong

Here is the actual key (not re-encrypted), password is “test”

Code: Select all

-----BEGIN ENCRYPTED PRIVATE KEY-----
MIHjME4GCSqGSIb3DQEFDTBBMCkGCSqGSIb3DQEFDDAcBAjYEIxF8bIqWQICCAAw
DAYIKoZIhvcNAgkFADAUBggqhkiG9w0DBwQIdPduQJSRLuIEgZCtt5NBI0mreSJy
5ZmgYq8KZpBnhcKstWo27VhCZuQAtayCXvt1/gmN0NlPWJyVNzrt808X7+HpMB+V
NKoiSI+kQHthocKyEfARub6UDyGtbcrQSNXi8LTfqAxH2ur6izVqDmeHO2BZCq8p
8y0clUoRDZ+LLYJ88bvJXAmRldJx9Xo4mKmrlvGZBpjfAr5qUN0=
-----END ENCRYPTED PRIVATE KEY-----

[TinCanTech]

See --askpass in The Manual v24x

[Matteo13]

See --askpass in The Manual v24x

Mmmh, how is this supposed to work? I am indeed being asked for a password, it’s just not accepted:

Code: Select all

EVENT: CORE_ERROR mbed TLS: error parsing config private key : PKCS5 - Requested encryption or digest alg not available [ERR]

[ordex]

seems like the problem hasn't been solved. Could you please open a bug on the bugtracker? viewtopic.php?f=36&t=25650

Thanks!

[ordex]

One last thing: does this happen only with EC keys? or also with RSA ones?

[Matteo13]

One last thing: does this happen only with EC keys? or also with RSA ones?

Yes, with RSA keys as well.

[Telegraphen-Mast]

I have the same issue since version 1.2.9
Is there any progress or did someone find a workaround?

[Telegraphen-Mast]

I found a way.
I do
openssl pkcs8 -topk8 -out pkcs8.key -in client.key -v1 PBE-SHA1-3DES
on the server and install the file along with the config.

more info here: https://community.openvpn.net/openvpn/t ... num_hist=5

[pool1689]

One last thing: does this happen only with EC keys? or also with RSA ones?

Yes, with RSA keys as well.