title: Problem with generating a PKCS#12 key from an RSA key
body: <p>I have a set of RSA keys which are used for testing. I am working on an enhancement for PKCS#12. The existing RSA keys all have a password on them, let's say "mypass". I want to generate three types of PKCS#12 keys:</p>
  
  <ul>
  <li>No password on the PKCS#12 envelope (which if you read <a href="https://serverfault.com/questions/515833/how-to-remove-private-key-password-from-pkcs12-container">this</a> is really the null string) and no password on the RSA key inside</li>
  <li>Password on the PKCS#12 envelope and no password on the RSA key inside</li>
  <li>Password on both the PKCS#12 envelop and the on the RSA key inside</li>
  </ul>
  
  <p>I'm having trouble with the first option category</p>
  
  <p>Here, I copy the PEM formatted source key into my workspace and create a decrypted version prefixed by the letter <code>d</code>. <code>$tkey</code> is the PEM formatted input key.</p>
  
  <pre><code>echo RSA keys PEM formatted
  key=${name}.priv.rsa.pem
  dkey=d${name}.priv.rsa.pem
  pubkey=${name}.pub.rsa.pem
  cp $tkey ./${key}
  openssl rsa -in $key -passin pass:mypass -out $dkey -outform pem -passout pass:
  </code></pre>
  
  <p>I think that the decrypted key doesn't have a password on it, because openssl does not prompt me for a password when I use it to sign some data.</p>
  
  <p>I do the following to generate my PKCS#12 keys (where <code>$tcert</code> is the path to input key's certificate).</p>
  
  <pre><code>tcert=`dirname $tkey`/${name}.crt
  key=${name}.priv.p12
  echo PKCS#12 envelope without password and unencrypted RSA key
  openssl pkcs12 -export -inkey $dkey -in $tcert -out d$key -name d$name  -passout pass:
  echo PKCS#12 envelope with password and unencrypted RSA key
  openssl pkcs12 -export -inkey $dkey -in $tcert -out x$key -name  $name  -passout pass:mypass
  echo PKCS#12 envelope with password and password protected RSA key
  openssl pkcs12 -export -inkey $tkey -in $tcert -out  $key -name  $name  -passout pass:mypass -passin pass:mypass
  </code></pre>
  
  <p>I then inspect each key doing the following (adding mypass as needed). When I go to display the <code>d</code> key, it asks me for a password for the RSA key. If I input "mypass", it dumps the key.</p>
  
  <pre><code>openssl pkcs12 -info -in $dkey -passin pass:
  </code></pre>
  
  <p>Since the above is scripted, I had the script echo the lines so that I could be sure that it was using the correct files and such.</p>
  
  <p>I'm obviously doing something wrong, but I don't see it.</p>