Data Domain: Certificate import failed. Unsupported algorithm used.

Summary: When trying to import certificate on a DD, it failes due to unsupported algorithm used to generate the cert.

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Instructions

PROBLEM STATEMENT:


sysadmin@DDhostname(active:1)# adminaccess certificate import host application all file DDhostname.p12
Enter password:

**   Importing the certificate will restart the http/https services and currently active http/https user sessions will be terminated.

        Do you want to import this certificate? (yes|no) [yes]: yes

**** Certificate import failed. Unsupported algorithm used.

Only "PBES2, PBKDF2, AES-256-CBC" (AES-256-CBC) encryption algorithm is supported for the PKCS12 file.

 

ROOT CAUSE:

The behavior change to require more secure algorithms was first added in 8.4 and then backported to 7.13.1.40 and 8.3.1.10. 

From the 8.4 Security Configuration Guide page 24:
"PKCS12 and PEM formats are supported. AES-256-CBC is the only supported encryption algorithm for PKCS12 files."

https://dl.dell.com/content/manual48623864-ddos-dell-powerprotect-data-domain-virtual-edition-and-powerprotect-dd-management-center-ddmc-8-4-security-configuration-guide.pdf?language=en-us (p24)

 

WORK AROUND / NOTES:

the non-compliant PKCS12 keystore file can be easily converted to a compliant keystore with AES-256-CBC algorithm by running the following 2 commands 

Step#1: Export private key and certificate from non-compliant PKCS#12 keystore file into PEM format:

 

openssl pkcs12 -in nonCompiantkeystore.p12  -nokeys -out cert.pem
openssl pkcs12 -in nonCompiantkeystore.p12  -nodes -nocerts -out key.pem

Step#2: Convert the exported keypair files to a compiant PKCS#12 keystore file:

 

openssl pkcs12 -export -in cert.pem -inkey key.pem -name  tomcat -out Compiantkeystore.p12 -macalg SHA256  -keypbe AES-256-CBC -certpbe AES-256-CBC -passout pass:DD_1234


Step#3: (Optional) Validate the converted file algorithm:

 

openssl pkcs12 -info -in Compiantkeystore.p12 -noout

openssl pkcs12 -info -in ddv.p12 -noout

openssl pkcs12 -in ddv.p12 -clcerts -nokeys -out cert.pem
openssl pkcs12 -in ddv.p12 -cacerts -nokeys -out public.pem
openssl pkcs12 -in ddv.p12 -nocerts -out key.pem
openssl rsa -in key.pem -out dkey.pem

openssl pkcs12 -export -out ddvnew.p12 -keypbe AES-256-CBC -certpbe AES-256-CBC -certfile public.pem -inkey dkey.pem -in cert.pem

Affected Products

Data Domain
Article Properties
Article Number: 000458521
Article Type: How To
Last Modified: 03 Sept 2026
Version:  1
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.