From 3e5d78e26012703b9208049a4a94a3e2ff09eed2 Mon Sep 17 00:00:00 2001 From: Christoph Blecker Date: Sat, 4 Feb 2017 17:03:46 -0800 Subject: [PATCH] Add PKCS#8 support to ParsePrivateKeyPEM --- staging/src/k8s.io/client-go/util/cert/pem.go | 28 +++++++++++++++---- 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/staging/src/k8s.io/client-go/util/cert/pem.go b/staging/src/k8s.io/client-go/util/cert/pem.go index 59e602d2f1c..e0b46d88a79 100644 --- a/staging/src/k8s.io/client-go/util/cert/pem.go +++ b/staging/src/k8s.io/client-go/util/cert/pem.go @@ -56,23 +56,39 @@ func EncodeCertPEM(cert *x509.Certificate) []byte { } // ParsePrivateKeyPEM returns a private key parsed from a PEM block in the supplied data. -// Recognizes PEM blocks for "EC PRIVATE KEY" and "RSA PRIVATE KEY" +// Recognizes PEM blocks for "EC PRIVATE KEY", "RSA PRIVATE KEY", or "PRIVATE KEY" func ParsePrivateKeyPEM(keyData []byte) (interface{}, error) { + var privateKeyPemBlock *pem.Block for { - var privateKeyPemBlock *pem.Block privateKeyPemBlock, keyData = pem.Decode(keyData) if privateKeyPemBlock == nil { - // we read all the PEM blocks and didn't recognize one - return nil, fmt.Errorf("no private key PEM block found") + break } switch privateKeyPemBlock.Type { case "EC PRIVATE KEY": - return x509.ParseECPrivateKey(privateKeyPemBlock.Bytes) + // ECDSA Private Key in ASN.1 format + if key, err := x509.ParseECPrivateKey(privateKeyPemBlock.Bytes); err == nil { + return key, nil + } case "RSA PRIVATE KEY": - return x509.ParsePKCS1PrivateKey(privateKeyPemBlock.Bytes) + // RSA Private Key in PKCS#1 format + if key, err := x509.ParsePKCS1PrivateKey(privateKeyPemBlock.Bytes); err == nil { + return key, nil + } + case "PRIVATE KEY": + // RSA or ECDSA Private Key in unencrypted PKCS#8 format + if key, err := x509.ParsePKCS8PrivateKey(privateKeyPemBlock.Bytes); err == nil { + return key, nil + } } + + // tolerate non-key PEM blocks for compatibility with things like "EC PARAMETERS" blocks + // originally, only the first PEM block was parsed and expected to be a key block } + + // we read all the PEM blocks and didn't recognize one + return nil, fmt.Errorf("data does not contain a valid RSA or ECDSA private key") } // ParseCertsPEM returns the x509.Certificates contained in the given PEM-encoded byte array