PKCS12_newpass.pod
3.22 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
=pod
=head1 NAME
PKCS12_newpass - change the password of a PKCS12 structure
=head1 SYNOPSIS
#include <openssl/pkcs12.h>
int PKCS12_newpass(PKCS12 *p12, const char *oldpass, const char *newpass);
=head1 DESCRIPTION
PKCS12_newpass() changes the password of a PKCS12 structure.
B<p12> is a pointer to a PKCS12 structure. B<oldpass> is the existing password
and B<newpass> is the new password.
=head1 NOTES
Each of B<oldpass> and B<newpass> is independently interpreted as a string in
the UTF-8 encoding. If it is not valid UTF-8, it is assumed to be ISO8859-1
instead.
In particular, this means that passwords in the locale character set
(or code page on Windows) must potentially be converted to UTF-8 before
use. This may include passwords from local text files, or input from
the terminal or command line. Refer to the documentation of
L<UI_OpenSSL(3)>, for example.
=head1 RETURN VALUES
PKCS12_newpass() returns 1 on success or 0 on failure. Applications can
retrieve the most recent error from PKCS12_newpass() with ERR_get_error().
=head1 EXAMPLE
This example loads a PKCS#12 file, changes its password and writes out
the result to a new file.
#include <stdio.h>
#include <stdlib.h>
#include <openssl/pem.h>
#include <openssl/err.h>
#include <openssl/pkcs12.h>
int main(int argc, char **argv)
{
FILE *fp;
PKCS12 *p12;
if (argc != 5) {
fprintf(stderr, "Usage: pkread p12file password newpass opfile\n");
return 1;
}
if ((fp = fopen(argv[1], "rb")) == NULL) {
fprintf(stderr, "Error opening file %s\n", argv[1]);
return 1;
}
p12 = d2i_PKCS12_fp(fp, NULL);
fclose(fp);
if (p12 == NULL) {
fprintf(stderr, "Error reading PKCS#12 file\n");
ERR_print_errors_fp(stderr);
return 1;
}
if (PKCS12_newpass(p12, argv[2], argv[3]) == 0) {
fprintf(stderr, "Error changing password\n");
ERR_print_errors_fp(stderr);
PKCS12_free(p12);
return 1;
}
if ((fp = fopen(argv[4], "wb")) == NULL) {
fprintf(stderr, "Error opening file %s\n", argv[4]);
PKCS12_free(p12);
return 1;
}
i2d_PKCS12_fp(fp, p12);
PKCS12_free(p12);
fclose(fp);
return 0;
}
=head1 NOTES
If the PKCS#12 structure does not have a password, then you must use the empty
string "" for B<oldpass>. Using NULL for B<oldpass> will result in a
PKCS12_newpass() failure.
If the wrong password is used for B<oldpass> then the function will fail,
with a MAC verification error. In rare cases the PKCS12 structure does not
contain a MAC: in this case it will usually fail with a decryption padding
error.
=head1 BUGS
The password format is a NULL terminated ASCII string which is converted to
Unicode form internally. As a result some passwords cannot be supplied to
this function.
=head1 SEE ALSO
L<PKCS12_create(3)>, L<ERR_get_error(3)>,
L<passphrase-encoding(7)>
=head1 COPYRIGHT
Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut