To generate FIPS compliant pkcs12 file using Openssl
2 years ago
Originally Published: 2009-12-07
Article Number
000040481
Issue
To generate FIPS compliant pkcs12 file using Openssl

In FIPS mode, when importing pkcs12 file created using openssl (with default options), R_PKCS12_DECODE returns error 10009 : NOT_AVAILABLE.

Cause
By default the private key is encrypted using triple DES. However, the certificate is encrypted using 40-bit RC2. RC2 is not a FIPS approved algorithm and therefore not available in the FIPS mode.

Resolution
Specify option -descert when using openssl pkcs12 as shows,

openssl pkcs12 -export -in <your server cert>.pem -inkey <your server key>.pem -out mycert.p12 -descert

The -descert option will instruct openssl to encrypt pkcs12 certificates with triple DES.

Don't see what you're looking for?