4

I have exported an existing certificate+key from an ASA 5510:

asa5510(config)# crypto ca export MYTRUSTSTORE pkcs12 MYPASSWORD

Saved the output in a file (vpn-cisco.pkcs12), and now I am trying to pull the cert and the key into separate files like so:

openssl pkcs12 -in cisco-vpn.pkcs12 -nocerts -out privateKey.pem

The error I receive:

139708630054816:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1319:
139708630054816:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:381:Type=PKCS12

Same error if I run openssl pkcs12 -info ... or any other command.

I have tried to export the file again and compare using ASDM instead of the CLI, but the file is exactly the same.

Googling for the error only says the encoding of the file might be somehow off, but no specific details.

  • 1
    Try first openssl base64 -in cisco-vpn.pkcs12 -d -out cisco-vpn.pkcs12.bin and after openssl pkcs12 -in cisco-vpn.pkcs12.bin -nocerts -out privateKey.pem – Federico Sierra Mar 20 '15 at 22:57
  • openssl base64 is the key here. openssl expects a binary form PKCS#12 file. – Jari Turkia Mar 9 '16 at 19:32
5

This is strange. I have the same problem and found this question to have no answer. I then did more searching and found a yaleman.org post that says they found the answer and linked to this very question. Yet there was no answer here. Retroactively fixing that, full props to yaleman.

Long and short: You need to convert the pfx from Base64 to openssl's binary format.

$ openssl enc -base64 -d -in certfile.pfx -out converted.pfx

Then you can convert it to a PEM and get the key or cert separately.

$ openssl pkcs12 -in converted.pfx -out bundle.pem -clcerts -nodes
1

If you have trouble with the decode, check your file and delete any blank lines in it. Our ASA was saving them with leading blanks and openssl doesn't like that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.