mirror of
https://github.com/hhftechnology/middleware-manager.git
synced 2026-10-19 15:33:35 +00:00
8f2c5861dc
An "incorrect password" error is received when importing the generated Client .p12 mTLS certificate on iOS.
My understanding is this is frequently caused by incompatible encryption methods between modern certificate generation tools (like OpenSSL 3.x and in this case SSLMate’s go-pkcs12 Modern) and iOS’s older security standards.
The relevant portion of code is below:
// Generate PKCS#12 (.p12) file
p12Data, err := pkcs12.Modern.Encode(clientKey, clientCert, []*x509.Certificate{caCert}, req.P12Password)
if err != nil {
return nil, fmt.Errorf("failed to generate PKCS#12: %w", err)
}
If this is changed to:
// Generate PKCS#12 (.p12) file
p12Data, err := pkcs12.Legacy.Encode(clientKey, clientCert, []*x509.Certificate{caCert}, req.P12Password)
if err != nil {
return nil, fmt.Errorf("failed to generate PKCS#12: %w", err)
}
The generated client certificates can be imported by iOS devices.
I have forked the repo and tested it (it works) but would not advocate this change. An option to select legacy (only when required) would be preferable. Unfortunately the changes to the database where certs and keys are stored and the UI to make Legacy selectable are beyond me.
|
||
|---|---|---|
| .. | ||
| src | ||
| components.json | ||
| index.html | ||
| package-lock.json | ||
| package.json | ||
| postcss.config.js | ||
| tailwind.config.ts | ||
| tsconfig.json | ||
| tsconfig.node.json | ||
| vite.config.ts | ||