Additional Info:
Apple uses LibreSSL3.3.6 in /usr/bin/openssl
Lengthy Wikipedia article about LibreSSL verses OpenSSL:
https://en.wikipedia.org/wiki/LibreSSL
Summary, serious security issues since the heartbleed exploit were raised and some in the SSL community decided to fork OpenSSL and re-write most of it. They reduced the code base considerably and increased security considerably. I believe that OpenSSL has made great strides since then. But BSD UNIX and Apple are on LibreSSL as well as a few select Linux distributions. Google seems that have done their own thing. While forking an open source project can be beneficial, it would be in everyones best interests if these events did not occur. Forks have happened in the past with other open source projects when disagreements arise and there is no compromise. No doubt there will be additional 'Gotchas' in future.
This particular issue relates to a design decision in OpenSSL to change the default cryto settings when creating /exporting PK12 public / private key certificates. Here's the source change from their GitHub repo:
Breaking change of OpenSSL 3.x with LibreSSL 3.x
https://github.com/openssl/openssl/commit/762970bd686c4aa8ea7169e7f76d5a4ce665da93
OpenSSL added the -legacy flag to offer backwards compatibility with systems such as Apple, BSD, etc. using LibreSSL or an older OpenSSL.
The Apple Keychain uses LibreSSL and it cannot read the certificate even with the correct password due to the default crypto method employed by OpenSSL. The -legacy flag creates the PK12 certificate using the previous crypto methods and thus creates a PK12 certificate that is readable with LibreSSL and thus the Apple Keychain.
Yes, this is very unpleasant to discover. In a perfect world this shouldn't have happened. But there are two distinct open source projects for SSL developers who disagree. I just wish problems like this were easier to find online. There's a metric ton of bad information on TLS/SSL in general as it is a complex topic that keeps evolving.
There is an excellent book, "Bulletproof SSL and TLS" by Ivan Ristić
- Publisher : Feisty Duck (August 1, 2014)
- ISBN-10 : 1907117040
- ISBN-13 : 978-1907117046
- Updated with TLS 1.3 recently
