Subject: RSA SSL encrypted private keys unreadable by Apache?

From: Mike Thompson <[email-masked]>
Date: Sat, 18 Jan 2003 00:34:41 -0500 (EST)

We're using RSA bsafe sslc22 libraries to generate a PKCS#8
encryypted RSA private key for Apache 2.0.39 mod_ssl
using openssl 0.9.6e. We can use the key in cleartext
but when we encrypt it Apache can't decrypt it.

The interesting thing is that the openssl rsa command
can read the key file, but Apache 2.0.39 based on the
same openssl 0.9.6e can't use the key file.

Using openssl to read / decrypt the private key and
then re-encrypting using the same passphrase produces a
key that Apache can use. I tried this using both des and
des3 encryption. Both work.

Any ideas on how to get Apache to accept the original key
the RSA routines or tweak the RSA code to produce a
key Apache can use? Thanks!

I'd guess the issue is with the encryption algorithm or
the header lines?

The RSA key is RSA private key encoded with PKCS#8
using SHA1 digest with DES-CBC in PEM format
(RFC 1421 common headers and trailers, not the
one that allows for variations.)
Here's the encrypted private key as written by the RSA
bsafe sslc22 application:

# more ssl.key/server.key
-----BEGIN ENCRYPTED PRIVATE KEY-----
-----END ENCRYPTED PRIVATE KEY-----

Here'e the same key after decrypting and re-encrypting using the
same passphrase using the following openssl command, I.e.

# openssl rsa -in ssl.key/server.key -des3 -out ssl.key/serverDes3.key

# more ssl.key/serverDes3.key
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,730497D7F6F3D777

-----END RSA PRIVATE KEY-----

For reference here is the key converted using openssl DES,
I.e. same as above but using des instead of des3 .

openssl rsa -in ssl.key/server.key -des  -out ssl.key/serverDes.key

# more ssl.key/serverDes.key
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-CBC,97632E1FC12295B9

-----END RSA PRIVATE KEY-----

Here's a default server key I generated through openssl independent
of the RSA application, not specifying a specific
encryption for reference:

# more ssl.key/serverDefault.key
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,FE82F2B632D9E58F

fUKPwuaWTnXju1Zisx/Ore1CxOmmk/wwR6MwmOXsJKgBKRxFQXc0RUJVJPuarqdN
vRkcZoY0nvRrURqe6GayxjZmn+Tl48y1RCSaVCjfHx9zsN0+T3mrbo+HmbSFI33P
<snip>.

Incidentally, we're using an executable program to produce the
Pass Phrase for decrypting the private key specified in the
directive:
SSLPassPhraseDialog
http://httpd.apache.org/docs-2.0/mod/mod_ssl.html#sslpassphrasedialog

That's unrelated to our problem though since after we decrypt /
re-encrypt with the openssl command line tool the Pass Phrase
program starts up the server no problem.

Later,          "A rainbow is only part of a circle." San Joser, CA
     ^ ^        Software Consultants:        http://www.migration.com/
     O o        Permanent:                   [email-masked]
  ===-o-===     My catbox:                   http://www.madkatz.com/
Ack! Phththpph!

2001 Clean Air Champion http://www.baaqmd.gov/pie/press/cachamp01.pdf

My True Zero Emission Vehicles (TZEV) GM EV1, Toyota RAV4 EV and
my home are powered by the 100% renewable, Zero Emissions
Electricity (ZEE) 30kWh/day Solar Electric (PV) system on my
roof which will pay for itself in about 6 years, 12% annualized
return on investment:
http://www.madkatz.com/pv/index.html

Sometimes I see gas cars... In my rearview mirror! http://www.gmev.com/

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]