Issue with Strimzi With Existing Private Key With Password

[mr1716]

Please use this to only for bug reports. For questions or when you need help, you can use the GitHub Discussions, our #strimzi Slack channel or out user mailing list.

Describe the bug
I am trying to create a Kafka listener with an external service using an externally signed CA. The CA and private key both have separate passwords. The error I get is:
Enter pass phrase for /opt/kafka/certificates/custom-external-9094-certs/tls.key:
User interface error
140334054004544:error:2807106B:UI routines:UI_process:processing error:crypto/ui/ui_lib.c:545:while reading strings
unable to load private key
140334054004544:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:crypto/evp/evp_enc.c:643:
140334054004544:error:23077074:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 cipherfinal error:crypto/pkcs12/p12_decr.c:63:
140334054004544:error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error:crypto/pkcs12/p12_decr.c:94:
140334054004544:error:0907B00D:PEM routines:PEM_read_bio_PrivateKey:ASN1 lib:crypto/pem/pem_pkey.c:

Expected behavior
I would expect it to work normally since we are following the directions provided directly by Strimzi.

[scholzj]

Strimzi currently does not support encrypted keys and there is no plan to support them. You should provide an unencrypted private and public keys in the PEM format.

[scholzj]

Why what? Why is it not supported? Because nobody implemented it I guess. Why is there no plan to support it? It would add complexity and maintenance effort. But TBH, I'm not sure what value it would actually add with a password sitting anyway next to the certificate. So I'm not sure what would it help with.

I would expect it to work normally since we are following the directions provided directly by Strimzi.

A note on this ... Strimzi nowhere mentions anything about it and doesn't give you any way to provide the password. So I'm not sure what directions are you following TBH.

[mr1716]

@scholzj thanks. I was following the directions at the following sites for using Strimzi: https://raw.githubusercontent.com/abhirockzz/kafka-kubernetes-strimzi/master/part-3/kafka-tls-auth.yaml
https://strimzi.io/docs/operators/latest/full/configuring.html#ref-alternative-subjects-certs-for-listeners-str

I will submit a ticket to update the documentation to reflect this finding so it is clear in the documentation.

[scholzj]

Well, feel free to open a PR to clarify that encrypted keys are not supported. I don't think anything really suggests it is supported, but it does not hurt to mention it explicitly I guess.

[mr1716]

@scholzj just because it doesnt explicitly say that it supports encrypted keys, it does not explicitly say that it doesn't. Therefore, by your logic, because it doesnt say that it cant support it, then it should support it. Hence it must be added

[scholzj]

TBH, as I said, there is no example using encrypted certificates, there are no fields for the passwords etc. So I think it is quite obvious. I marked the issue for triage, but I think you should at least suggest where you want to put it and not link to the whole documentation book.

[elvis-cai]

thanks for the explanation, we got the same issue today with private key with password, will try to go without password

STRIMZI_BROKER_ID=1
Preparing truststore for replication listener
Adding /opt/kafka/cluster-ca-certs/ca.crt to truststore /tmp/kafka/cluster.truststore.p12 with alias ca
Certificate was added to keystore
Preparing truststore for replication listener is complete
Looking for the right CA
Found the right CA: /opt/kafka/cluster-ca-certs/ca.crt
Preparing keystore for replication and clienttls listener
Preparing keystore for replication and clienttls listener is complete
Preparing store for custom-external-31090 listener
Creating keystore /tmp/kafka/custom-external-31090.keystore.p12
Enter pass phrase for /opt/kafka/certificates/custom-external-31090-certs/tls.key:
User interface error
140564403316544:error:2807106B:UI routines:UI_process:processing error:crypto/ui/ui_lib.c:545:while reading strings
unable to load private key
140564403316544:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:crypto/evp/evp_enc.c:643:
140564403316544:error:23077074:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 cipherfinal error:crypto/pkcs12/p12_decr.c:63:
140564403316544:error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error:crypto/pkcs12/p12_decr.c:94:
140564403316544:error:0907B00D:PEM routines:PEM_read_bio_PrivateKey:ASN1 lib:crypto/pem/pem_pkey.c:88: