Skip to content

Commit 8bce062

Browse files
committed
conf: fix support for private key PEM files other than PKCS#8
The Mbed TLS bug being worked around (Mbed-TLS/mbedtls#3896) affects _all_ PEM inputs. `conf_set_pem` only applied the workaround to certificates and PKCS#8 encoded keys. `-----BEGIN PRIVATE KEY-----` is the PKCS#8 PEM header called out in RFC 7468. While `-----BEGIN EC PRIVATE KEY-----` is not mentioned in that RFC, RFC 5915 does describe it as a "popular format" for using PEM encoding to store an EC key, and most crypto libraries implement it.
1 parent 509717f commit 8bce062

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

common/commandline.c

+2-1
Original file line numberDiff line numberDiff line change
@@ -303,7 +303,8 @@ void conf_set_pem(const struct storage_parse_info *info, void *raw_dest, const v
303303
ret < 0 ? strerror(errno) : "Short read");
304304
dest->iov_len = ret;
305305
if (strstr(dest_str, "-----BEGIN CERTIFICATE-----") ||
306-
strstr(dest_str, "-----BEGIN PRIVATE KEY-----"))
306+
strstr(dest_str, "-----BEGIN PRIVATE KEY-----") ||
307+
strstr(dest_str, "-----BEGIN EC PRIVATE KEY-----"))
307308
dest->iov_len++;
308309
close(fd);
309310
}

0 commit comments

Comments
 (0)