please update the output proxy certificate pem filenames in the user doc page

[randria]

Maybe just a small detail (for newbies like me) in user page but it should be written that the

certificate files (public and private keys in .pem (Privacy Enhanced Mail format)

MUST BE respectively have the filename usercert.pem and userkey.pem because it is hard-coded in lines 31-32 dirac_cert_convert.py when you have converted the p12 file with the script

dirac-cert-convert

But if you do the conversion in another way by using openssl-pkcs12 you will certainly put randomly a filename output for your public and private key and surely not usercert.pem or userkey.pem if it's not mentionned you can't guess ;-) And you will not understand why DIRAC yells after a dirac-proxy-init ...

2023-12-06 14:11:22 UTC dirac-proxy-init [140704294048960] DEBUG: Updating configuration internals
2023-12-06 14:11:22 UTC dirac-proxy-init [140704294048960] NOTICE: Generating proxy...
2023-12-06 14:11:22 UTC dirac-proxy-init [140704294048960] ERROR: Can't find user certificate and key

[marianne013]

You are right, but all grid services look for usercert.pem and userkey.pem unless you tell them otherwise, it's not just DIRAC.

[randria]

and by the way I also found this issue when I used openssl pkcs12 to convert p12 to pem with these options which always works for me...

openssl pkcs12 -in certificate.p12 -info -noout

output

MAC: sha1, Iteration 1
MAC length: 20, salt length: 8
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048
Error outputting keys and certificates
C0147745F87F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:342:Global default library context, Algorithm (RC2-40-CBC : 0), Properties ()

and this issue is since the openssl v3.x. It seems that newer cryptographic algorithms are used that may not be supported in older versions of Java, Windows, etc.

So you need to fix it by adding -legacy option if the openssl > 3.x and this is not fixed in the dirac convert script if I am not wrong.

openssl pkcs12 -in certificate.p12 -out cert.pem -info -noout -legacy

output

MAC: sha1, Iteration 1
MAC length: 20, salt length: 8
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048
Certificate bag
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048

references

• https://www.misterpki.com/openssl-pkcs12-legacy/
• https://www.openssl.org/news/openssl-3.0-notes.html

  Moved all variations of the EVP ciphers CAST5, BF, IDEA, SEED, RC2, RC4, RC5, and DES to the legacy provider.

[fstagni]

I can't see this:

 |-> openssl pkcs12 -in myCertificate.p12 -info -noout
Enter Import Password:
MAC: sha1, Iteration 2048
MAC length: 20, salt length: 8
PKCS7 Data
Certificate bag
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048

For:

 |-> openssl version
OpenSSL 3.0.7 1 Nov 2022 (Library: OpenSSL 3.0.7 1 Nov 2022)

[fstagni]

Maybe just a small detail (for newbies like me) in user page but it should be written that the

certificate files (public and private keys in .pem (Privacy Enhanced Mail format)

MUST BE respectively have the filename usercert.pem and userkey.pem because it is hard-coded in lines 31-32 dirac_cert_convert.py when you have converted the p12 file with the script

Added in #7351