c - Inserting a certificate into the keychain -



c - Inserting a certificate into the keychain -

i have client retrieves certificate (.pfx), including private key, server , add together local keychain next code: -

void addcerttokeychain(const qbytearray& cert, const qstring& password) { seckeychainref keychain = nil; osstatus err = seckeychaincopydomaindefault(ksecpreferencesdomainuser, &keychain); if (err != errsecsuccess) { emit log("failed access scheme keychain: " + logmessageforstatus(err)); return; } secexternalformat format = ksecformatpkcs12; secexternalitemtype itemtype = ksecitemtypeaggregate; secitemimportexportflags flags = 0; secitemimportexportkeyparameters params; memset(&params, 0, sizeof(params)); params.version = sec_key_import_export_params_version; params.flags = 0; params.passphrase = password.tocfstring(); params.alerttitle = null; params.alertprompt = null; params.accessref = null; // create , populate key usage array cfmutablearrayref keyusage = cfarraycreatemutable( kcfallocatordefault, 0, &kcftypearraycallbacks ); cfarrayappendvalue(keyusage, ksecattrcanencrypt); cfarrayappendvalue(keyusage, ksecattrcandecrypt); cfarrayappendvalue(keyusage, ksecattrcanderive); cfarrayappendvalue(keyusage, ksecattrcansign); cfarrayappendvalue(keyusage, ksecattrcanverify); cfarrayappendvalue(keyusage, ksecattrcanwrap); cfarrayappendvalue(keyusage, ksecattrcanunwrap); keyusage = null; // error without - failed import certificate: key usage mask not supported. // create , populate key attributes array cfmutablearrayref keyattributes = cfarraycreatemutable( kcfallocatordefault, 0, &kcftypearraycallbacks ); // required import params.keyusage = keyusage; params.keyattributes = keyattributes; osstatus status = secitemimport(cert.tocfdata(), cfstr(".p12"), &format, &itemtype, flags, &params, keychain, null); if(status == errsecsuccess) emit log("certificate imported"); else { emit log("failed import certificate: " + logmessageforstatus(status)); } }

the certificate , private key appear in keychain, expected.

however, trying retrieve certificate problem, either programmatically or using keychain application.

if select export private key keychain, i'm provided next error in dialog: -

"an error has occurred. unable export item. contents of item cannot retrieved"

however, if certificate , key added keychain double-clicking on pfx, exporting key works expected.

so, why code above cause problem of not beingness able export key?

with assistance of quinn @ apple, seems method described in question should work, doesn't.

using old cdsa style flag instead in fact work, doing this: -

osstatus err; secexternalformat format; secitemimportexportkeyparameters params; params.version = sec_key_import_export_params_version; params.flags = 0; params.passphrase = (__bridge cfstringref) pkcs12password; params.alerttitle = null; params.alertprompt = null; params.accessref = null; params.keyusage = null; params.keyattributes = (__bridge cfarrayref) @[ @(cssm_keyattr_extractable) ]; format = ksecformatpkcs12; err = secitemimport( (__bridge cfdataref) pkcs12data, cfstr("p12"), &format, null, 0, &params, keychain, null );

note setting of params.keyattributes, defines key extractable.

alternatively, older (deprecated) seckeychainitemimport api may used: -

bool success; osstatus err; nsarray * result; secexternalformat format; seckeyimportexportparameters params; cfarrayref importeditems; result = nil; importeditems = null; format = ksecformatpkcs12; memset(&params, 0, sizeof(params)); params.passphrase = password; params.keyattributes = cssm_keyattr_extractable; err = seckeychainitemimport( (cfdataref) pkcs12blob, // importeddata null, // filenameorextension &format, // inputformat null, // itemtype 0, // flags &params, // keyparams self->keychain, // importkeychain &importeditems // outitems ); success = (err == noerr);

while function seckeychainitemimport defined deprecated in apple's documentation, have been informed it's unlikely removed time soon.

c osx security ssl core-foundation

Comments

Post a Comment

Popular posts from this blog

c - Compilation of a code: unkown type name string -

c - Compilation of a code: unkown type name string - i have next lines of code compiler says following: "unknown type name 'string'" both in declaration , definition of function. can tell me what's wrong? thanks. #include <stdio.h> #include <stdlib.h> #include <string.h> void frecognizeclient(string *actualclient) there no string type in c. need utilize array so: char array[10]; then can pass in function: void frecognizeclient(char *actualclient); c arrays string compilation
Read more

java - Bypassing "final local variable defined in an enclosing type" -

java - Bypassing "final local variable defined in an enclosing type" - i'm writing programme , i'm getting "the final local variable asd cannot assigned, since it's defined in enclosing type". i provide illustration not code produces error aswell. have arraylist utilize later (if define within button can't utilize later on), outside of button, pressing button should give values arraylist. in illustration "create new arraylist" cause same problem. button btn = new button("asd"); final arraylist asd = new arraylist(); btn.setonaction(new eventhandler<actionevent>() { public void handle(final actionevent event) { asd = new arraylist(); //here's error.. } }); clear arraylist , add together values. java javafx
Read more

json - Hibernate and Jackson (java.lang.IllegalStateException: Cannot call sendError() after the response has been committed) -

json - Hibernate and Jackson (java.lang.IllegalStateException: Cannot call sendError() after the response has been committed) - hello have problem hibernate , jackson. have 2 pojos @entity @table(name = "users") public class user implements serializable { static final long serialversionuid = 4235637833262722256l; @id @generatedvalue private int id; @column(name = "creation_date") private date creationdate; @column(name = "first_name") private string firstname; @column(name = "last_name") private string lastname; @version @column(name = "version") private int version; @column(name = "e_mail") private string email; @column(name = "enabled") private boolean enabled; @column(name = "login") private string login; @column(name = "password") private string password; @jsonmanagedreference("role") @onetomany(mappedby = "user", cascade = cascadetype.all,fetch = fetchtyp...
Read more