Hi,
I have a project which uses OpenSSL and SecPKCS12Import API. with open ssl 1.x this was working smoothly. but recently after the update in openssl 3.x SecPKCS12Import starts failing with the error:
SecPKCS12Import Optional(Error Domain=NSOSStatusErrorDomain Code=-25293 "The user name or passphrase you entered is not correct." UserInfo={NSLocalizedDescription=The user name or passphrase you entered is not correct.})
Technology used:
Xcode: 14.0.1
OpenSSL: 3.0.5
iOS: 16
Selecting any option will automatically load the page
Post
Replies
Boosts
Views
Activity
software used:
xcode: 14.1
swift: 4
openssl v3
when trying to import the p12 certificate with SecPKCS12Import, it is failing with the following error:
Error Domain=NSOSStatusErrorDomain Code=-25293 "The user name or passphrase you entered is not correct." UserInfo={NSLocalizedDescription=The user name or passphrase you entered is not correct.})
-25293
The p12 certificate is created using AES-256-CBC.
This p12 file is passed through the following method that returned Data and then sent to SecPKCS12Import API.
BIO* createPKCS12fromPKCS12(const unsigned char* data, long dataLength, char* originalPassphrase, char* newPassphrase) {
OSSL_PROVIDER defaultProvider = OSSL_PROVIDER_try_load(NULL, "default", 1);
BIO bp = BIO_new_mem_buf(data, (int)dataLength);
PKCS12* originalPKCS12 = NULL;
d2i_PKCS12_bio(bp, &originalPKCS12);
BIO_free(bp);
EVP_PKEY* privateKey;
X509* x509;
STACK_OF(X509)* caChain = NULL;
PKCS12_parse(originalPKCS12, originalPassphrase, &privateKey, &x509, &caChain);
PKCS12_free(originalPKCS12);
PKCS12* newPKCS12 = PKCS12_create(newPassphrase, "SAP Identity", privateKey, x509, caChain, 149, 146, 0, 0, 0);
unsigned long a = ERR_get_error();
printf("%lu", a);
EVP_PKEY_free(privateKey);
X509_free(x509);
sk_X509_free(caChain);
BIO* mem = NULL;
if (newPKCS12 != NULL) {
mem = BIO_new(BIO_s_mem());
i2d_PKCS12_bio(mem, newPKCS12);
PKCS12_free(newPKCS12);
}
return mem;
}
let err = SecPKCS12Import(pkcs12Data as CFData, query as CFDictionary, &items)
print("error in:: SecPKCS12Import", err.error, "\n", err)
If required, we may share the p12 certificate and associate password with you to debug it further.