What happens if key file is encrypted with a pass phares?

[gcg]

Hey there,

Sorry if this is a stupid question but I did not see anywhere where I can enter the pass phrase for the key file.

Without it when I try to use NewClientWithFiles method, it just gives me the following error.

2016/01/13 11:16:32 Could not create clientcrypto/tls: failed to parse private key

I tried my cert and key file with openssl client and they worked fine. I am also using the same files on the production with my api (php).

New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : AES256-SHA
    Session-ID:
    Session-ID-ctx:
    Master-Key: 0C21677365B5EE5EA621FE5C3464C8B750A574E1ED632D34AF683121305054F4C12409D672C1B9F4BFCD89685671AA13
    Key-Arg   : None
    Start Time: 1452678448
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)

---
asdasdasd
closed

[nathany]

It's using tls.X509KeyPair under the hood to load PEM files, which afaik doesn't support pass phrases.

If you prefer to use a .p12 file, take a look at this certificate package which does support passwords. https://godoc.org/github.com/RobotsAndPencils/buford/certificate

[gcg]

I exported the key file again from p12 without adding a passphrase for now.

But I think it is kind of a should have feature because all the popular tutorials about creating pem files for apns directs you to create a key.pem with a pass phrase.

If you don't think that its necessary we can close this issue.

Thank you again for this lib. Cheers.

[taylortrimble]

Yes, currently key files must be unencrypted. For server applications, this makes sense; passwords only hold power if they are entered from memory by a user and are cleared from memory after use, which is hard to do in a server environment where reloading is probably going to be transparent. If the password is part of a config, then it's as easy to lift as the encrypted key. :stuck_out_tongue_winking_eye:

I'd guess wildly and irresponsibly that's why the Go team hasn't support encrypted key files themselves yet.

[nathany]

I'm closing this because afaik the issue is actually with Go's crypto package not supporting pem with a passphrase.

As mentioned previously, you can use .p12 files with a passphrase with Buford, which also provides support for Apple's new HTTP/2 API. https://github.com/timehop/apns/issues/66#issuecomment-171487326