{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/829","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/829/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/829/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/829/events","html_url":"https://github.com/hashicorp/vault/pull/829","id":121334817,"number":829,"title":"Add parsing of pkcs#8-encoded bundles for pki/config/ca","user":{"login":"andrewstuart","id":2635025,"avatar_url":"https://avatars.githubusercontent.com/u/2635025?v=3","gravatar_id":"","url":"https://api.github.com/users/andrewstuart","html_url":"https://github.com/andrewstuart","followers_url":"https://api.github.com/users/andrewstuart/followers","following_url":"https://api.github.com/users/andrewstuart/following{/other_user}","gists_url":"https://api.github.com/users/andrewstuart/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewstuart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewstuart/subscriptions","organizations_url":"https://api.github.com/users/andrewstuart/orgs","repos_url":"https://api.github.com/users/andrewstuart/repos","events_url":"https://api.github.com/users/andrewstuart/events{/privacy}","received_events_url":"https://api.github.com/users/andrewstuart/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/hashicorp/vault/milestones/5","html_url":"https://github.com/hashicorp/vault/milestones/0.5.0","labels_url":"https://api.github.com/repos/hashicorp/vault/milestones/5/labels","id":1381611,"number":5,"title":"0.5.0","description":null,"creator":{"login":"jefferai","id":28627,"avatar_url":"https://avatars.githubusercontent.com/u/28627?v=3","gravatar_id":"","url":"https://api.github.com/users/jefferai","html_url":"https://github.com/jefferai","followers_url":"https://api.github.com/users/jefferai/followers","following_url":"https://api.github.com/users/jefferai/following{/other_user}","gists_url":"https://api.github.com/users/jefferai/gists{/gist_id}","starred_url":"https://api.github.com/users/jefferai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jefferai/subscriptions","organizations_url":"https://api.github.com/users/jefferai/orgs","repos_url":"https://api.github.com/users/jefferai/repos","events_url":"https://api.github.com/users/jefferai/events{/privacy}","received_events_url":"https://api.github.com/users/jefferai/received_events","type":"User","site_admin":false},"open_issues":4,"closed_issues":0,"state":"open","created_at":"2015-10-28T15:09:50Z","updated_at":"2015-12-09T20:51:18Z","due_on":null,"closed_at":null},"comments":10,"created_at":"2015-12-09T20:44:03Z","updated_at":"2015-12-11T15:47:19Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/hashicorp/vault/pulls/829","html_url":"https://github.com/hashicorp/vault/pull/829","diff_url":"https://github.com/hashicorp/vault/pull/829.diff","patch_url":"https://github.com/hashicorp/vault/pull/829.patch"},"body":"I was running into issues writing my cert bundle to the config/ca endpoint, so did a little testing and noticed that my key had been encoded with pkcs8, which vault wasn't handling. \r\n\r\nI updated tests, and made sure that they were all passing, so this shouldn't break any existing code as far as I can tell.\r\n\r\nI essentially followed the exact strategy used in the official tls library for parsing a private key:\r\nhttps://github.com/golang/go/blob/be16001187f17e9c312e69c353be743cc7d9e260/src/crypto/tls/tls.go#L273-L290"},"comment":{"url":"https://api.github.com/repos/hashicorp/vault/issues/comments/163969537","html_url":"https://github.com/hashicorp/vault/pull/829#issuecomment-163969537","issue_url":"https://api.github.com/repos/hashicorp/vault/issues/829","id":163969537,"user":{"login":"jefferai","id":28627,"avatar_url":"https://avatars.githubusercontent.com/u/28627?v=3","gravatar_id":"","url":"https://api.github.com/users/jefferai","html_url":"https://github.com/jefferai","followers_url":"https://api.github.com/users/jefferai/followers","following_url":"https://api.github.com/users/jefferai/following{/other_user}","gists_url":"https://api.github.com/users/jefferai/gists{/gist_id}","starred_url":"https://api.github.com/users/jefferai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jefferai/subscriptions","organizations_url":"https://api.github.com/users/jefferai/orgs","repos_url":"https://api.github.com/users/jefferai/repos","events_url":"https://api.github.com/users/jefferai/events{/privacy}","received_events_url":"https://api.github.com/users/jefferai/received_events","type":"User","site_admin":false},"created_at":"2015-12-11T15:47:19Z","updated_at":"2015-12-11T15:47:19Z","body":">  if /pki ever supports EC, since EC keys can use pkcs8\r\n\r\nIt fully supports EC! In 0.2 due to Go 1.4 it didn't support EC CA keys since Go couldn't generate CSRs using them, but it could generate EC keys for issued certs. In 0.4 against Go 1.5 it's fully supported everywhere.\r\n\r\nAfter thinking through what you said, I'm also leaning towards keeping things native. But, I don't think we need to actually store the format in the PKI backend. Probably what we should do is add a \"PrivateKeyFormat\" iota with the default being PKCS1Format to ParsedCertBundle (and ParsedCSRBundle).\r\n\r\nThe nice thing is that we never actually marshal private keys in this code, except when generating a new key. So it's just a matter of ensuring that we retain the right formatting -- which is what you were doing, but I'm not sure what was causing the problem you ran into earlier.\r\n\r\nIn ParsePEMBundle we can make things a bit less dumb in the current case by keying off of the pem.Block's Type parameter for keys -- RSA PRIVATE KEY, EC PRIVATE KEY mean parse as RSA or EC and error if they don't work. Then, PRIVATE KEY causes the current behavior of first attempting one, then the other, and marking the PrivateKeyFormat as PKCS8Format.\r\n\r\nThen it's a matter of two things:\r\n\r\n1. Plumbing support for that format flag through the rest of certutil. That will be easy in most places, just some extra cases in switch statements.\r\n2. Ensuring that in ToParsedCertBundle, it reads the pem.Block's Type parameter again, because as long as that was written correctly in ToCertBundle, we used the original PKCS8 bytes in the PEM encoding. So it has similar logic to ParsePEMBundle (maybe it can be pulled out into a helper function) to determine both the type and format of the PEM block.\r\n\r\nDoes that sound good?"}}