Security

last person joined: 22 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Wildcard cert will not import without a passphrase

This thread has been viewed 13 times

  • 1.  Wildcard cert will not import without a passphrase

    Posted Nov 15, 2017 12:03 PM

    Hi,

     

    I have a *.domain.com certificate for HTTPS that was generated without a passphrase to protect the private key.  ClearPass would not import it.

     

    Going through openssl to aes256 encrypt the private key with a passphrase worked in the command line, but ClearPass complained, something about the header being invalid.

     

    Is there any special signing requirements for being able to import the private key?



  • 2.  RE: Wildcard cert will not import without a passphrase

    EMPLOYEE
    Posted Nov 15, 2017 12:14 PM
    Did you try importing a plain text key?


  • 3.  RE: Wildcard cert will not import without a passphrase

    Posted Nov 15, 2017 12:39 PM

    Yes I've tried: when trying to import the plain-text private key without putting in the passphrase, ClearPass cert import section said "Private Key Password must be specified"

     



  • 4.  RE: Wildcard cert will not import without a passphrase

    Posted Nov 15, 2017 12:41 PM

    A tangential question which may help is: what is the internal SSL/Signing component that ClearPass uses?  Is it OpenSSL?  Maybe there are compatibility issues I could hunt down.



  • 5.  RE: Wildcard cert will not import without a passphrase

    EMPLOYEE
    Posted Nov 15, 2017 12:43 PM
    Yes, you need to specify a strong password during import. This will be used to protect the key if exported from the system.


  • 6.  RE: Wildcard cert will not import without a passphrase

    Posted Nov 15, 2017 12:50 PM

    Yes, I agree about the need for a private key being protected.  However, this private key - as supplied - is not.

     

    Importing the plain-text private key didn't work.  So I tried applying a passphrase.

     

    ClearPass didn't like the private key after I had it signed with the passphrase.

     

    So if there isn't a way around not using a passphrase, is there any guidance on the formatting or header requirements of the private key?



  • 7.  RE: Wildcard cert will not import without a passphrase

    EMPLOYEE
    Posted Nov 15, 2017 12:52 PM
    Don't apply a passphrase externally. Upload the clear text key and then enter a passphrase in the box.


  • 8.  RE: Wildcard cert will not import without a passphrase

    Posted Nov 15, 2017 01:34 PM

    When you do that, it says the "Private Key could not be loaded (password may not be correct)"

     

    I think I'll have to try and passphrase encrypt it again from CLI via openSSL.  I just wish I knew what ClearPass was looking for in the Private key.



  • 9.  RE: Wildcard cert will not import without a passphrase

    EMPLOYEE
    Posted Nov 15, 2017 06:21 PM
    ClearPass will accept a traditional PKCS#8 key or a PKCS#5 v2.0 encrypted private key (des3)


  • 10.  RE: Wildcard cert will not import without a passphrase

    Posted Nov 15, 2017 07:38 PM
    Thanks, that helps. I'll see if I can sort it out.