From eac14ef19dc39d737c10eb388bc633ae95317a1c Mon Sep 17 00:00:00 2001 From: per1234 Date: Wed, 7 Dec 2022 02:45:50 -0800 Subject: [PATCH] Use OpenSSL "legacy" provider in "Check Certificates" for compatibility w/ RC2-40-CBC encrypted PKS#12 The "Check Certificates" GitHub Actions workflow template uses OpenSSL to check for problems with the project's signing certificates. Certificates exported to PKS #12 archive files using older tools may have been encrypted using the "RC2-40-CBC" algorithm. Due to the availability of more secure modern alternatives, default support for RC2-40-CBC encryption was dropped in OpenSSL 3.x. The macOS signing certificate currently used by Arduino uses this RC2-40-CBC encryption. The "Check Certificates" GitHub Actions workflow runs on the `ubuntu-latest` runner. Previously, this runner used Ubuntu 20.04. This has now changed to Ubuntu 22.04. With the operating system update came an OpenSSL update from 1.1.1f to 3.0.2. This caused the workflow runs to fail on the macOS certificate job: Error outputting keys and certificates 80FBB0C5087F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:../crypto/evp/evp_fetch.c:349:Global default library context, Algorithm (RC2-40-CBC : 0), Properties () Even though no longer done by default, OpenSSL still supports RC2-40-CBC encryption via its "legacy" provider. So compatibility with the certificate is restored by adding the `-legacy` flag to the `openssl pkcs12` commands. --- workflow-templates/check-certificates.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/workflow-templates/check-certificates.yml b/workflow-templates/check-certificates.yml index 7547fb90..acc9244b 100644 --- a/workflow-templates/check-certificates.yml +++ b/workflow-templates/check-certificates.yml @@ -95,7 +95,9 @@ jobs: ( openssl pkcs12 \ -in "${{ env.CERTIFICATE_PATH }}" \ - -noout -passin env:CERTIFICATE_PASSWORD + -legacy \ + -noout \ + -passin env:CERTIFICATE_PASSWORD ) || ( echo "::error::Verification of ${{ matrix.certificate.identifier }} failed!!!" exit 1 @@ -123,6 +125,7 @@ jobs: openssl pkcs12 \ -in "${{ env.CERTIFICATE_PATH }}" \ -clcerts \ + -legacy \ -nodes \ -passin env:CERTIFICATE_PASSWORD ) | (