{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/829","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/829/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/829/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/829/events","html_url":"https://github.com/hashicorp/vault/pull/829","id":121334817,"number":829,"title":"Add parsing of pkcs#8-encoded bundles for pki/config/ca","user":{"login":"andrewstuart","id":2635025,"avatar_url":"https://avatars.githubusercontent.com/u/2635025?v=3","gravatar_id":"","url":"https://api.github.com/users/andrewstuart","html_url":"https://github.com/andrewstuart","followers_url":"https://api.github.com/users/andrewstuart/followers","following_url":"https://api.github.com/users/andrewstuart/following{/other_user}","gists_url":"https://api.github.com/users/andrewstuart/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewstuart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewstuart/subscriptions","organizations_url":"https://api.github.com/users/andrewstuart/orgs","repos_url":"https://api.github.com/users/andrewstuart/repos","events_url":"https://api.github.com/users/andrewstuart/events{/privacy}","received_events_url":"https://api.github.com/users/andrewstuart/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/hashicorp/vault/milestones/5","html_url":"https://github.com/hashicorp/vault/milestones/0.5.0","labels_url":"https://api.github.com/repos/hashicorp/vault/milestones/5/labels","id":1381611,"number":5,"title":"0.5.0","description":null,"creator":{"login":"jefferai","id":28627,"avatar_url":"https://avatars.githubusercontent.com/u/28627?v=3","gravatar_id":"","url":"https://api.github.com/users/jefferai","html_url":"https://github.com/jefferai","followers_url":"https://api.github.com/users/jefferai/followers","following_url":"https://api.github.com/users/jefferai/following{/other_user}","gists_url":"https://api.github.com/users/jefferai/gists{/gist_id}","starred_url":"https://api.github.com/users/jefferai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jefferai/subscriptions","organizations_url":"https://api.github.com/users/jefferai/orgs","repos_url":"https://api.github.com/users/jefferai/repos","events_url":"https://api.github.com/users/jefferai/events{/privacy}","received_events_url":"https://api.github.com/users/jefferai/received_events","type":"User","site_admin":false},"open_issues":4,"closed_issues":0,"state":"open","created_at":"2015-10-28T15:09:50Z","updated_at":"2015-12-09T20:51:18Z","due_on":null,"closed_at":null},"comments":8,"created_at":"2015-12-09T20:44:03Z","updated_at":"2015-12-11T00:28:19Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/hashicorp/vault/pulls/829","html_url":"https://github.com/hashicorp/vault/pull/829","diff_url":"https://github.com/hashicorp/vault/pull/829.diff","patch_url":"https://github.com/hashicorp/vault/pull/829.patch"},"body":"I was running into issues writing my cert bundle to the config/ca endpoint, so did a little testing and noticed that my key had been encoded with pkcs8, which vault wasn't handling. \r\n\r\nI updated tests, and made sure that they were all passing, so this shouldn't break any existing code as far as I can tell.\r\n\r\nI essentially followed the exact strategy used in the official tls library for parsing a private key:\r\nhttps://github.com/golang/go/blob/be16001187f17e9c312e69c353be743cc7d9e260/src/crypto/tls/tls.go#L273-L290"},"comment":{"url":"https://api.github.com/repos/hashicorp/vault/issues/comments/163794884","html_url":"https://github.com/hashicorp/vault/pull/829#issuecomment-163794884","issue_url":"https://api.github.com/repos/hashicorp/vault/issues/829","id":163794884,"user":{"login":"jefferai","id":28627,"avatar_url":"https://avatars.githubusercontent.com/u/28627?v=3","gravatar_id":"","url":"https://api.github.com/users/jefferai","html_url":"https://github.com/jefferai","followers_url":"https://api.github.com/users/jefferai/followers","following_url":"https://api.github.com/users/jefferai/following{/other_user}","gists_url":"https://api.github.com/users/jefferai/gists{/gist_id}","starred_url":"https://api.github.com/users/jefferai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jefferai/subscriptions","organizations_url":"https://api.github.com/users/jefferai/orgs","repos_url":"https://api.github.com/users/jefferai/repos","events_url":"https://api.github.com/users/jefferai/events{/privacy}","received_events_url":"https://api.github.com/users/jefferai/received_events","type":"User","site_admin":false},"created_at":"2015-12-11T00:28:19Z","updated_at":"2015-12-11T00:28:19Z","body":"So `certutil` and `pki` are totally separate, except that `pki` uses `certutil` as a helper library -- and as you found, the fact that `pki` is using `certutil` doesn't mean it supports all functionality.\r\n\r\nIn fact, in this case it can't (by default)...the Go `x509` package doesn't actually have a function to marshal RSA keys in PKCS8 format -- only to parse. So any RSA keys generated by the `pki` backend will never actually use the `pkcs8` property and will always be in PKCS1 format.\r\n\r\nI'd have to look at why it was failing to issue certificates, but my guess is that when you read in a PEM block into a `ParsedCertBundle` it stores the parsed key (e.g. a `*rsa.PrivateKey`) but also stores the actual bytes, which are in PKCS8 format. When you convert that into a `CertBundle` it simply takes those bytes (again, still PKCS8) and encodes in a PEM block...this is then stored. Coming back, it should read the PEM block, create a `CertBundle`, and call `ToParsedCertBundle` -- but as you noted this isn't storing the `pkcs8` bool because it's not the parsed bundle that's stored in the `pki` backend. So if the code in `ToParsedCertBundle` is not then properly checking for the PKCS8 case, it'll fail, and while I don't have the code in front of me, I think you only put in a check in the PEM reading helper, not in ToParsedCertBundle.\r\n\r\nThat said, at this point, I wonder if in fact plumbing everything through right now is moot: it is useful, other than in an academic sense, once `certutil` has parsed the private key from a PKCS8 PEM block, to ever think about it in terms of PKCS8 again? I wonder if at this point in time we're just needlessly complicating the situation because we can't re-marshal it out as PKCS8 anyways, and that once it's parsed in as a private key, we should only consider it as a private key of a specific type (but not format), and only ever worry about exporting it in PKCS1 format since that's all Go supports anyways. So the solution there would be, if we found a PKCS8-encoded RSA key, to parse it, then immediately call `MarshalPKCS1PrivateKey` on the returned `*rsa.PrivateKey` to get the PKCS1 bytes, then store *that* in the ParsedCertBundle.\r\n\r\nWhat do you think?"}}