Environment$ cat /etc/*-releaseCentOS release 6.5 (Final)$ openssl versionOpenSSL 1.0.1e-fips 11 Feb 2013This works$ tr -dc A-Za-z0-9 </dev/random | head -c 24 > ${f_host_passphrase}$ echo -e \n >> ${f_host_passphrase}$ openssl genpkey ... -pass file:${f_host_passphrase} -out ${f_host_key}$ openssl req ... -key ${f_host_key} -passin file:${f_host_passphrase} \    -out ${f_host_req}$ openssl ca ... -in ${f_host_req} -out ${f_host_cert}$ openssl pkcs12 \  -export \  -inkey ${f_host_key} \  -passin pass:$(cat ${f_host_passphrase}) \  -in ${f_host_cert} \  -name ${l_ds_cert_name} \  -password file:${f_host_passphrase} \  -out ${f_host_p12}...$ pk12util -i ${f_host_p12} \  -w ${f_host_passphrase} \  -d ${l_sql_prefix}${d_nssdb} \  -k ${f_host_passphrase}pk12util: PKCS12 IMPORT SUCCESSFULThe full, functional script is here. I wrote the script for rapid testing because, it turns out, this next variation fails.This fails$ tr -dc A-Za-z0-9 </dev/random | head -c 24 > ${f_host_passphrase}$ echo -e \n >> ${f_host_passphrase}$ openssl genpkey ... -pass file:${f_host_passphrase} -out ${f_host_key}$ openssl req ... -key ${f_host_key} -passin file:${f_host_passphrase} \    -out ${f_host_req}$ openssl ca ... -in ${f_host_req} -out ${f_host_cert}$ openssl pkcs12 \  -export \  -inkey ${f_host_key} \  -passin file:${f_host_passphrase} \  -in ${f_host_cert} \  -name ${l_ds_cert_name} \  -password file:${f_host_passphrase} \  -out ${f_host_p12}...$ pk12util -i ${f_host_p12} \  -w ${f_host_passphrase} \  -d ${l_sql_prefix}${d_nssdb} \  -k ${f_host_passphrase}pk12util: PKCS12 decode not verified: SEC_ERROR_BAD_PASSWORD: The security password entered is incorrect.Why?The only difference between the two variations (and the failed openssl pkcs12 command is a comment block in the script to which I linked) is how I pass the passphrase file to the openssl pkcs12 command.If I send the passphrase as -passin pass:$(cat ${f_host_passphrase}), the following pk12util command succeeds.If I send the passphrase as -passin file:${f_host_passphrase}, the openssl pkcs12 command still succeeds, but the pk12util command fails.My guess is that the openssl pkcs12 command is parsing something as the password from the -passin file:${f_host_passphrase} argument. Just not what the rest of world is expecting to use...
OpenSSL 1.0.1e usage bug?
openssl