Error: Unsupported Algorithm When Extracting Public Certificate from PKCS#12 File #23089

EthanTang-Zq · 2023-12-19T06:39:05Z

EthanTang-Zq
Dec 19, 2023

Problem Description:
When running the following command:

openssl pkcs12 -in testit.aggsimida.com-Entire_certificate-030332.p12 -clcerts -nokeys -out public.crt
I encountered the following error:

Enter Import Password:
Error outputting keys and certificates
801B5126747F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:../crypto/evp/evp_fetch.c:349:Global default library context, Algorithm (RC2-40-CBC : 0), Properties ()

Version Information:
OpenSSL Version: OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)
Operating System: Ubuntu 22.04

Steps to Reproduce:
Run the above OpenSSL command.
Enter the import password when prompted.

Expected Behavior:
Expecting to successfully extract the public certificate without encountering errors.

Actual Behavior:
Encountered an error related to the unsupported algorithm.

Answered by mattcaswell

Dec 19, 2023

801B5126747F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:../crypto/evp/evp_fetch.c:349:Global default library context, Algorithm (RC2-40-CBC : 0), Properties ()

This tells you that the file has been encrypted with an unsupported encryption algorithm (RC2-40-CBC). That algorithm is now considered legacy and insecure. The algorithm is still available in our legacy provider. Please try adding "-legacy" to your command line.

View full answer

nhorman · 2023-12-19T07:58:19Z

nhorman
Dec 19, 2023
Maintainer

Can you post the output of the following command please:

./configdata.pm --dump

I suspect that your openssl build doesn't have the rc2 algorithm included in your configuration

0 replies

EthanTang-Zq · 2023-12-19T08:06:40Z

EthanTang-Zq
Dec 19, 2023
Author

Please run this command in which directory. I am using openssl in the Ubuntu software package.

0 replies

mattcaswell · 2023-12-19T10:25:44Z

mattcaswell
Dec 19, 2023
Maintainer

801B5126747F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:../crypto/evp/evp_fetch.c:349:Global default library context, Algorithm (RC2-40-CBC : 0), Properties ()

This tells you that the file has been encrypted with an unsupported encryption algorithm (RC2-40-CBC). That algorithm is now considered legacy and insecure. The algorithm is still available in our legacy provider. Please try adding "-legacy" to your command line.

13 replies

matthaighdj Nov 25, 2024

This worked for me too!

anhtukhtn Dec 23, 2024

thank you. worked for me

jerrickhakim Feb 8, 2025

@mattcaswell I can't tell you how thankful I am for your answer! Much love ✌️.

simionattovini-axxis Apr 3, 2025

Some heroes don't wear capes!

meorramzi Jun 5, 2025

Thank you very much ! worked for me !!

saviour123 · 2024-03-06T10:00:26Z

saviour123
Mar 6, 2024

With -legacy flag. This worked for me as mentioned.

$ openssl pkcs12 -in fileWith.p12 -out Output.pem -nodes -nocerts -legacy

0 replies

raryum · 2025-02-03T20:01:55Z

raryum
Feb 3, 2025

this method didn't work for me, this time it gave another error
openssl pkcs12 -in PfxDosyam.pfx -out certificate.crt -nodes -nocerts -legacy

pkcs12: unable to load provider legacy
Hint: use -provider-path option or OPENSSL_MODULES environment variable.
1C230000:error:12800067:DSO support routines:win32_load:could not load the shared library:crypto\dso\dso_win32.c:108:filename(C:\Program Files\OpenSSL\lib\ossl-modules\legacy.dll)
1C230000:error:12800067:DSO support routines:DSO_load:could not load the shared library:crypto\dso\dso_lib.c:147:
1C230000:error:07880025:common libcrypto routines:provider_init:reason(37):crypto\provider_core.c:950:name=legacy

When I do not type -legacy, I get the following error

Error outputting keys and certificates
3C3C0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto\evp\evp_fetch.c:355:Global default library context, Algorithm (RC2-40-CBC : 0), Properties ()

3 replies

rutuja-dhore Mar 3, 2025

i have the same issue. have you got an update on this

saviour123 Mar 3, 2025

@raryum @rutuja-dhore I would recommend, you switch to Linux Subsystem for Windows and do it on it, My solution was for LINUX/UNIX

He-Man321 Mar 7, 2025

Hi,
I got a very similar issue when I tired this. My first question is why is Let's Encrypt\Crypt LE outputting .pfx files with an old cypher (RC2-40-CBC) and is that a problem? Using -legacy does solve the issue (see below) but are we papering over a nasty crack here and should we be finding out how to not use RC2-40-CBC in the first place?

but to resolve the issue, I found the legacy.dll in the "openssl-3.4.1\x64\lib\ossl-modules" folder and copied it in to the openssl folder and then used the -provider-path thus:
openssl/openssl pkcs12 -in example.com.pfx -nocerts -out example.com-key.pem -nodes -password pass:password -legacy -provider-path ./openssl
Note: because I am writing a script to do this on bulk I am calling the command from the folder above where the openssl.exe sits.

SamTopspin · 2025-04-11T00:12:14Z

SamTopspin
Apr 11, 2025

Reinstalled/upgraded to the latest OpenSSL few days ago (coincidently) and then today encountered this error.
For me specifying the path worked like a charm, here is the command that worked.

openssl pkcs12 -in cert1.pfx -out cert1.pem -nocerts -provider-path "C:\Program Files\OpenSSL-Win64\bin" -legacy

0 replies

Uh oh!

Error: Unsupported Algorithm When Extracting Public Certificate from PKCS#12 File #23089

Uh oh!

Replies: 6 comments · 16 replies

Uh oh!

nhorman Dec 19, 2023 Maintainer

Uh oh!

EthanTang-Zq Dec 19, 2023 Author

Uh oh!

mattcaswell Dec 19, 2023 Maintainer

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Replies: 6 comments 16 replies

nhorman
Dec 19, 2023
Maintainer

EthanTang-Zq
Dec 19, 2023
Author

mattcaswell
Dec 19, 2023
Maintainer