Description of problem:

A customer could not create a pem file including CA certificate with -cacerts option.


# openssl pkcs12 -in <pkcs12 file> -cacerts -out test.pem

# cat test.pem
Bag Attributes
    friendlyName: CA certificate
    localKeyID: 39 38 1D 57 12 4B 0A AA 09 95 0D D4 94 2D 71 B8 D2 2E 01 B9 
Key Attributes: <No Attributes>
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIICzzBJBgkqhkiG9w0BBQ0wPDAbBgkqhkiG9w0BBQwwDgQILsXmx5nABNYCAggA
... snip ...
IM/q
-----END ENCRYPTED PRIVATE KEY-----

This includes a private key only. As a result, the following openssl x509 command failed.

# openssl x509 -in test.pem -text
unable to load certificate
140074918438816:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: TRUSTED CERTIFICATE

The pkcs12 file includes the certificate certainly, it can be confirmed with pk12util -l <pkcs12 file>.

When -cacerts is specified, if the bag includes Local Key ID attribute, the certificate is not dumpped in the following code.

apps/pkcs12.c:

    761 int dump_certs_pkeys_bag (BIO *out, PKCS12_SAFEBAG *bag, char *pass,
    762              int passlen, int options, char *pempass)
    763 {
...
    800         case NID_certBag:
    801                 if (options & INFO) BIO_printf (bio_err, "Certificate bag\n");
    802                 if (options & NOCERTS) return 1;
    803                 if (PKCS12_get_attr(bag, NID_localKeyID)) {
    804                         if (options & CACERTS) return 1;
                                    <== if localkeyID is available, return here.
    805                 } else if (options & CLCERTS) return 1;


When -cacerts is not used or -clcerts is used, the certificate is output. So, it seems that it's regarded as a user certificate. Also, the bag has a localKeyID attribute.

# cat test.pem
... snip ...
Bag Attributes
    friendlyName: CA certificate
    localKeyID: 39 38 1D 57 12 4B 0A AA 09 95 0D D4 94 2D 71 B8 D2 2E 01 B9 
subject=/CN=CAcert
issuer=/CN=CAcert
-----BEGIN CERTIFICATE-----
MIIBlzCCAQCgAwIBAgICA+gwDQYJKoZIhvcNAQEFBQAwETEPMA0GA1UEAxMGQ0Fj
... snip ...
iJxa32pZMfzA6tX9oUNi9t/mOU58kpjKmyIF
-----END CERTIFICATE-----


I was not sure what is localkeyID for exactly, but it seems that it comes from SHA1 fingerprint.

From the output from p12util -l <pkcs12 file>

    Fingerprint (SHA1):
        39:38:1D:57:12:4B:0A:AA:09:95:0D:D4:94:2D:71:B8:D2:2E:01:B9

It seems that the if-statement in above code shows that a certificate with local key id is not qualified for CA certificate. But, in this use case, the CA certificate also has the attribute of local key id. 

Version-Release number of selected component (if applicable):
Red Hat Enterprise Linux 7.1

How reproducible:
Always.

Steps to Reproduce:

1) create pwdfile.txt

# cat /root/pwdfile.txt
cde45tgb

2) create noise.txt

# cat /root/noise.txt 
dsadasdasdasdadasdasdasdasdsadfwerwerjfdksdjfksdlfhjsdk

3) generate CA certificate and server certificate upon 

# cd /root
# certutil -N -d . -f pwdfile.txt
# certutil -G -d . -z noise.txt -f pwdfile.txt
# certutil -S -n "CA certificate" -s "cn=CAcert" -x -t "T,," -m 1000 -v 120 -d . -z noise.txt -f pwdfile.txt
# certutil -S -n "Server-Cert" -s "cn=test.redhat.com,cn=Directory Server" -c "CA certificate" -t "u,u,u" -m 1001 -v 120 -d . -z noise.txt -f pwdfile.txt

4) Export CA certificate and key.

# pk12util -o test.p12 -n "CA certificate" -d .
# pk12util -l test.p12

5) Convert into pem format with -cacerts option

# openssl pkcs12 -in test.p12 -out test.pem -cacert

6) check test.pem

# cat test.pem
# openssl x509 -in test.pem -text  <<=== failed


Actual results:
-cacerts cannot output the CA certificate.

Expected results:
-cacerts can output the CA certificate properly.

Additional info: