Using LetsEncrypt's certbot will by default generate a private key in
PKCS#8 format, not the PKCS#1 "Traditional" format. This CAN be used
with Pike, but the most obvious way to parse certificates and keys
does not work with this.
Example:
object pem = Standards.PEM.Messages(Stdio.read_file("privkey.pem") +
Stdio.read_file("fullchain.pem"));
pem->get_private_keys(); //Empty array, no PK found
string pk = pem->get_fragments((<"PRIVATE KEY">))[0]->body; //This
does return a valid key though
object ctx = SSL.Context();
//ctx->add_cert(pk, pem->get_certificates()); //Fails - unable to parse key
ctx->add_cert(Standards.PKCS.parse_private_key(pk),
pem->get_certificates()); //Succeeds!
What would be the consequences of adding support for the PKCS#8 type
to these two convenience functions? This would be a simple change in
each of two places - see branch rosuav/pkcs8-key-parsing - but there
may be other consequences that I'm not aware of.
Anyone with more SSL knowledge than me able to weigh in?
ChrisA