EXAMPLE

This example loads a PKCS#12 file, changes its password and writes out the result to a new file.

#include <stdio.h>
#include <stdlib.h>
#include <openssl/pem.h>
#include <openssl/err.h>
#include <openssl/pkcs12.h>

int main(int argc, char **argv)
{
   FILE *fp;
   PKCS12 *p12;
   if (argc != 5) {
       fprintf(stderr, "Usage: pkread p12file password newpass opfile\n");
       return 1;
   }
   if ((fp = fopen(argv[1], "rb")) == NULL) {
       fprintf(stderr, "Error opening file %s\n", argv[1]);
       return 1;
   }
   p12 = d2i_PKCS12_fp(fp, NULL);
   fclose(fp);
   if (p12 == NULL) {
       fprintf(stderr, "Error reading PKCS#12 file\n");
       ERR_print_errors_fp(stderr);
       return 1;
   }
   if (PKCS12_newpass(p12, argv[2], argv[3]) == 0) {
       fprintf(stderr, "Error changing password\n");
       ERR_print_errors_fp(stderr);
       PKCS12_free(p12);
       return 1;
   }
   if ((fp = fopen(argv[4], "wb")) == NULL) {
       fprintf(stderr, "Error opening file %s\n", argv[4]);
       PKCS12_free(p12);
       return 1;
   }
   i2d_PKCS12_fp(fp, p12);
   PKCS12_free(p12);
   fclose(fp);
   return 0;
}

NOTES

If the PKCS#12 structure does not have a password, then you must use the empty string "" for oldpass. Using NULL for oldpass will result in a PKCS12_newpass() failure.

If the wrong password is used for oldpass then the function will fail, with a MAC verification error. In rare cases the PKCS12 structure does not contain a MAC: in this case it will usually fail with a decryption padding error.

BUGS

The password format is a NULL terminated ASCII string which is converted to Unicode form internally. As a result some passwords cannot be supplied to this function.

SEE ALSO