certtool generates pkcs12 files packaged using pkcs5PBES2
(1.2.840.113549.1.5.13) and pkcs5PBKDF2 (1.2.840.113549.1.5.12) and
aes128-CBC (2.16.840.1.101.3.4.1.2).
I've attached one of these files to this report. You can generate
them yourself with:
certtool --to-p12 \
--load-privkey "alice.pem" \
--load-certificate "alice-cert.pem" \
--outfile "alice.p12.der" \
--password 'abc123' \
--outraw \
--template /dev/stdin <<EOFpkcs12_key_name = "alice"
EOF
Trying to import this file into gpgsm fails:
0 dkg@pip:~/src/gmimetest/testkeys$ gpgsm --fixed-passphrase abc123 --import
alice.p12.der
gpgsm: gpgsm: GPG_TTY has not been set - using maybe bogus default
gpgsm: gpg-protect-tool: encryptedData error at "bag.encryptedData.keyinfo",
offset 79
gpgsm: gpg-protect-tool: error at "bag.encryptedData", offset 49
gpgsm: gpg-protect-tool: error parsing or decrypting the PKCS-12 file
gpgsm: error running `/usr/lib/gnupg2/gpg-protect-tool': exit status 2
gpgsm: total number processed: 0
2 dkg@pip:~/src/gmimetest/testkeys$
It would be really good if gpgsm could interoperate with the PKI
material produced by certtool.
fwiw, openssl seems to have no problem reading the same blob:
openssl pkcs12 -nodes -passin pass:abc123 < alice.p12.der
I tested this with gpgsm 2.0.17-2 from debian.