Can't import SSL certificates: "Could not parse the PEM-encoded import data"

[nick_chevsky]

I'm trying to import an RSA private key and X.509 server certificate into an ICX6450-C12-PD running FastIron 08.0.30u as follows:

(config)#ip ssl private-key-file tftp 1.2.3.4 key.pem
Downloading RSA private key file, please wait...
Done.
Download RSA certificate data file to create the certificate.
(config)#ip ssl certificate-data-file tftp 1.2.3.4 cert.pem
Downloading RSA certicate data file, please wait...
Done.

Creating certificate, please wait...

This consistently fails with error:

Cert import failed....Could not parse the PEM-encoded import data

Things I've tried:

• 2048-bit and 1024-bit RSA keys
• Encrypted and unencrypted keys
  
• SHA-256 and SHA-1 signatures
  
• v3 and v1 certificates
• Bare-minimum certificates without any extensions
• Subject Name fields matching Brocade defaults
• LF and CRLF line endings
• No line breaks at all

Is this feature even functional at all? Neither the Command Reference nor the Security Configuration Guide specify supported file formats, but my test cases have covered even the most legacy, compatible extremes without success.

[jijo_panangat]

Hello basteagow, 

Have you already tried with the filename without extensions, like the one below.

(config)#ip ssl certificate-data-file tftp 192.168.9.210 certfile
(config)#ip ssl private-key-file tftp 192.168.9.210 keyfile

We would need a debugging session to have a better understanding of the problem, Could you please open a tac case.


Thanks
Jijo

[nick_chevsky]

I have, yes, but the filenames aren't the problem—the switch is successfully downloading both files, and the TFTP server's logs confirm this.

I tried enabling debug ip ssl, but no log entries are generated during the import process. Is there somewhere else I can look for debug info?

Can you post a sample key/certificate pair that successfully imports for you, and specify the switch model and FastIron version on which it succeeds? If your files fail to import for me, we can then narrow this down further.

[jijo_panangat]

Hi Basteagow,

This forum is only for quick questions, For config review and file sharing we would appreciate if a tac case can be opened. This will help us to look into the problem remotely and debug live.


Thanks
Jijo

[nick_chevsky]

I opened case # 01074612 but was rejected due to not having a support contract.

Considering how many different combinations of key and certificate types I've tried (all of which match what the documentation claims is supported), I'm very confident that this is either a bug or something that should be better documented—and in either case, the certificate import code should at the very least be printing more useful, granular error messages.

If this feature was implemented well, I wouldn't be needing support in the first place. Could you guys make an exception to the support contract requirement and see if this works on your end?

Thanks very much in advance!