Bug 1440873

Description of problem:
curl does not support EC certificates

Version-Release number of selected component (if applicable):
7.53.1-4

How reproducible:
Always

Steps to Reproduce:
1. openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp521r1 -out pkcs8-pem.key
2. openssl pkey -in pkcs8-pem.key -outform DER -out pkcs8-der.key
3. openssl pkey -in pkcs8-pem.key -outform PEM -traditional -out traditional-pem.key
4. openssl pkey -in pkcs8-pem.key -outform DER -traditional -out traditional-der.key
5. openssl pkey -pubout -in pkcs8-pem.key | please-give-me-a-certificate -out cert.pem
6. curl --cert cert.pem --key pkcs8-pem.key https://test.invalid/
7. curl --cert cert.pem --key pkcs8-der.key https://test.invalid/
8. curl --cert cert.pem --key traditional-pem.key https://test.invalid/
9. curl --cert cert.pem --key traditional-der.key https://test.invalid/

Actual results:
None of the invocations of curl work:

$ curl --cert cert.pem --key pkcs8-pem.key https://test.invalid/
*   Trying 192.0.2.1...
* TCP_NODELAY set
* Connected to test.invalid (192.0.2.1) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS: client certificate from file
* 	subject: CN=certificate
* 	start date: Mar 28 00:00:00 2017 GMT
* 	expire date: Apr 27 00:00:00 2017 GMT
* 	common name: certificate
* 	issuer: CN=ca
* NSS error -8152 (SEC_ERROR_INVALID_KEY)
* The key does not support the requested operation.
* stopped the pause stream!
* Closing connection 0
curl: (35) The key does not support the requested operation.

$ curl --cert cert.pem --key pkcs8-der.key https://test.invalid/
*   Trying 192.0.2.1...
* TCP_NODELAY set
* Connected to test.invalid (192.0.2.1) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS: client certificate from file
* 	subject: CN=certificate
* 	start date: Mar 28 00:00:00 2017 GMT
* 	expire date: Apr 27 00:00:00 2017 GMT
* 	common name: certificate
* 	issuer: CN=ca
* NSS error -8152 (SEC_ERROR_INVALID_KEY)
* The key does not support the requested operation.
* stopped the pause stream!
* Closing connection 0
curl: (35) The key does not support the requested operation.

$ curl --cert cert.pem --key traditional-pem.key https://test.invalid/
*   Trying 192.0.2.1...
* TCP_NODELAY set
* Connected to test.invalid (192.0.2.1) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* unable to load client key: -8178 (SEC_ERROR_BAD_KEY)
* NSS error -8178 (SEC_ERROR_BAD_KEY)
* Peer's public key is invalid.
* Closing connection 0
curl: (58) unable to load client key: -8178 (SEC_ERROR_BAD_KEY)

$ curl --cert cert.pem --key traditional-der.key https://test.invalid/
*   Trying 192.0.2.1...
* TCP_NODELAY set
* Connected to test.invalid (192.0.2.1) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS: client certificate from file
* 	subject: CN=certificate
* 	start date: Mar 28 00:00:00 2017 GMT
* 	expire date: Apr 27 00:00:00 2017 GMT
* 	common name: certificate
* 	issuer: CN=ca
* NSS error -8152 (SEC_ERROR_INVALID_KEY)
* The key does not support the requested operation.
* stopped the pause stream!
* Closing connection 0
curl: (35) The key does not support the requested operation.

Expected results:
At least one (preferably all) of the invocations of curl works.

Additional info:
1. The command please-give-me-a-certificate, the domain test.invalid and the IP address 192.0.2.1 are used as an example. It should be relatively straightforward to guess what they mean.
2. These tests don't cover loading keys from nssdb.
3. Some of the invocations work if RSA keys are used instead.
4. pkcs8-pem.key works with both openssl s_client and gnutls-cli.