search

snstac / pytak

PyTAK is a Python package for rapid TAK integration.
https://pytak.readthedocs.io/en/stable/
Apache License 2.0
162 stars 45 forks source link

Encrypted TLS Private Keys (Private Keys with Passphrases) #12

Closed ampledata closed 11 months ago

ampledata commented 3 years ago

There is currently no mechanism to set a passphrase for a TLS Private Key (that is, a Private Key that is encrypted with a Passphrase) for a pytak-based tool. This means that you cannot run a pytak-based tool in the background or as a service, as the tool has no means of accepting a passphrase for the private key from a user.

It's probably possible to add support for this, but in the mean-time, a work-around is to decrypt the Private Key and use that with the pytak-tool, instead of the encrypted Private Key.

For example, given the encrypted Private key 'my_cert.key.pem', you can decrypt the private key and remove the passphrase with this command:

$ openssl rsa -in my_cert.key.pem -out my_cert-nopass.key.pem

This will result in a new file my_cert-nopass.key.pem that you can then pass to the pytak-based tool:

export PYTAK_TLS_CLIENT_KEY=my_cert-nopass.key.pem

Or inline:

PYTAK_TLS_CLIENT_KEY=my_cert-nopass.key.pem aprscot ...

Or with systemd:

Environment=PYTAK_TLS_CLIENT_KEY=my_cert-nopass.key.pem