Data Domain: Certificate import failed. Unsupported algorithm used.
Résumé: When trying to import certificate on a DD, it failes due to unsupported algorithm used to generate the cert.
Instructions
PROBLEM STATEMENT:
sysadmin@DDhostname(active:1)# adminaccess certificate import host application all file DDhostname.p12
Enter password:
** Importing the certificate will restart the http/https services and currently active http/https user sessions will be terminated.
Do you want to import this certificate? (yes|no) [yes]: yes
**** Certificate import failed. Unsupported algorithm used.
Only "PBES2, PBKDF2, AES-256-CBC" (AES-256-CBC) encryption algorithm is supported for the PKCS12 file.
ROOT CAUSE:
The behavior change to require more secure algorithms was first added in 8.4 and then backported to 7.13.1.40 and 8.3.1.10.
From the 8.4 Security Configuration Guide page 24:
"PKCS12 and PEM formats are supported. AES-256-CBC is the only supported encryption algorithm for PKCS12 files."
WORK AROUND / NOTES:
the non-compliant PKCS12 keystore file can be easily converted to a compliant keystore with AES-256-CBC algorithm by running the following 2 commands
Step#1: Export private key and certificate from non-compliant PKCS#12 keystore file into PEM format:
openssl pkcs12 -in nonCompiantkeystore.p12 -nokeys -out cert.pem
openssl pkcs12 -in nonCompiantkeystore.p12 -nodes -nocerts -out key.pem
Step#2: Convert the exported keypair files to a compiant PKCS#12 keystore file:
openssl pkcs12 -export -in cert.pem -inkey key.pem -name tomcat -out Compiantkeystore.p12 -macalg SHA256 -keypbe AES-256-CBC -certpbe AES-256-CBC -passout pass:DD_1234
Step#3: (Optional) Validate the converted file algorithm:
openssl pkcs12 -info -in Compiantkeystore.p12 -noout
openssl pkcs12 -info -in ddv.p12 -noout
openssl pkcs12 -in ddv.p12 -clcerts -nokeys -out cert.pem
openssl pkcs12 -in ddv.p12 -cacerts -nokeys -out public.pem
openssl pkcs12 -in ddv.p12 -nocerts -out key.pem
openssl rsa -in key.pem -out dkey.pem
openssl pkcs12 -export -out ddvnew.p12 -keypbe AES-256-CBC -certpbe AES-256-CBC -certfile public.pem -inkey dkey.pem -in cert.pem