1

I'm trying to use a PCKS12 client certificate with curl 7.58.0 and OpenSSL 1.1.1 on Ubuntu 18.04 server.
My certificate info is:

~# openssl pkcs12 -info -in cert.p12 -noout -nomacver
Enter Import Password:
MAC: sha1, Iteration 1
MAC length: 20, salt length: 8
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048
Certificate bag
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048

When I try to use it with curl like this:

curl --cert-type P12 --cert cert.p12:******* https://server.com

I get

curl: (58) could not load PKCS12 client certificate, OpenSSL error error:140AB18E:SSL routines:SSL_CTX_use_certificate:ca md too weak

How can I make curl/openssl accept this certificate?
I tried --insecure and --tlsv1.0 but none of them worked for me.


EDIT
Output of openssl pkcs12 -in cert.p12 -nokeys | openssl x509 -text -noout is:

Enter Import Password:
MAC verified OK
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1558524593 (0x5ce532b1)
    Signature Algorithm: md5WithRSAEncryption
        Issuer: C=IR, ST=Tehran, O=IPM, OU=IRNIC dotIR ccTLD, CN=IRNIC department/emailAddress=info@nic.ir
        Validity
            Not Before: May 22 11:29:53 2019 GMT
            Not After : Nov 22 11:29:53 2019 GMT
        Subject: C=IR, ST=Tehran, L=Tehran, O=Hamid Reza Naeini, OU=Hamid Reza Naeini, CN=da74-irnic,T234/emailAddress=nic@fanavaidc.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:de:57:fa:8c:7f:44:18:87:58:04:73:91:be:1a:
                    f4:5d:63:22:7c:79:a8:b8:7c:af:13:91:39:6e:11:
                    5d:f6:e7:70:13:d0:0f:9c:38:90:f5:13:da:c1:d1:
                    5d:73:8b:85:d0:00:bf:0f:ad:c3:e4:a3:91:87:51:
                    10:e2:b8:3b:03:fe:44:82:7b:4f:e4:b2:29:43:9c:
                    bb:33:7d:1d:2b:81:76:55:1d:69:57:fe:ac:ec:0f:
                    a6:4c:ec:4b:a1:0c:10:63:f5:ec:c7:1f:8a:68:e9:
                    95:7a:4c:22:21:47:5f:50:22:e8:c9:60:b2:c2:89:
                    5c:da:73:df:b1:e3:bf:66:71
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                40:F0:CE:06:33:DD:40:3B:69:F2:97:89:43:EF:8D:12:BB:88:E7:2A
            X509v3 Authority Key Identifier: 
                keyid:FC:D4:95:B1:9E:AD:B8:1B:94:09:3B:77:A1:CF:09:D7:F5:D6:BE:BE
                DirName:/C=IR/ST=Tehran/O=IPM/OU=IRNIC dotIR ccTLD/CN=IRNIC department/emailAddress=info@nic.ir
                serial:AF:4A:3A:99:D9:CE:99:C1

            X509v3 Basic Constraints: 
                CA:TRUE
    Signature Algorithm: md5WithRSAEncryption
         88:a7:d8:8e:63:6f:15:69:cd:45:31:8b:2e:14:f1:48:bf:66:
         24:33:b5:ef:6d:5f:75:8b:31:f2:94:09:b6:c2:72:87:09:b8:
         31:4c:8b:c5:8d:b0:03:f3:70:91:63:fc:ed:52:19:62:31:98:
         82:e4:e9:e8:14:2a:c9:6c:ca:fc:3f:d6:e0:fc:d2:94:82:88:
         4e:0b:5a:77:74:19:de:99:17:e8:ba:c9:58:b9:6f:d9:e6:c9:
         f6:de:26:e7:6e:2e:02:4d:f9:2c:6b:e2:1f:9f:0a:7a:35:d0:
         5e:9c:cd:09:74:fa:df:a4:c8:5a:42:82:91:8c:6f:68:a9:06:
         14:51:1f:22:46:8f:0b:db:13:1d:17:bc:b2:c1:fd:41:5b:5b:
         2b:57:9c:cf:a8:7f:64:2a:4b:6e:a6:e6:37:c4:b0:3b:ef:11:
         df:90:d3:b7:65:aa:40:40:f4:cd:d1:87:4d:22:20:4b:4b:13:
         bc:e8:14:79:c5:a9:14:6d:6e:6b:22:8e:21:27:44:26:23:8d:
         a0:2f:38:21:03:7f:cd:e1:cb:dc:51:d7:a5:a5:87:af:a3:65:
         d1:a3:7c:84:78:43:c6:74:40:fe:fd:97:5c:23:ad:ec:5f:a1:
         ef:05:89:ac:5c:85:20:74:17:f9:95:cf:66:30:73:ec:04:0f:
         41:67:8c:3a
5
  • 1
    That initial openssl command doesn't tell you/us anything about the certificate (only info about the PKCS12 file that holds it). Run openssl pkcs12 -in cert.p12 -nokeys | openssl x509 -text -noout and paste the output into your question. Sep 2 '19 at 9:45
  • @garethTheRed: please check my update on the question
    – Ariyan
    Sep 2 '19 at 10:08
  • 1
    Instead of attempting to force curl to load that certificate you should as the issuer why they've issued you a certificate with a 1024-bit key and MD5 hash, especially considering it's marked as a CA certificate!. That hashing algorithm has been broken for years and should not be used, while 1024-bits is considered to short to be secure. Sep 2 '19 at 10:19
  • @garethTheRed: Yes you are right; but i am not the issuer! this cert is issued by a TLD authority (nic.ir - the authority of .ir TLD) to give me access to their API and I need to use it as client certificate; I tried to contact them and ask for another one but they don't accept to change the cert! so unfortunately I need to stick to this one! without this key I can not even open their web site!
    – Ariyan
    Sep 2 '19 at 10:33
  • 1
    I believe OpenSSL from 1.1 onward does not accept MD5 certificates. Maybe your only option is to downgrade to an earlier version of Ubuntu, or compile OpenSSL yourself. Sep 2 '19 at 12:21
1

Surprisingly you can downgrade your OS to use older version of curl and it's being okay! We are use Ubuntu 16.04 instead of 19.10 and we can connect to nic server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.