I've tried to import existing CA with
set pki ca testca certificate 'MII<cut>==' set pki ca testca private key 'MII<cut>=='
but commit failed with
Invalid private key on CA certificate "testca"
I did some digging on the implementation in pki.py and here's what I've found:
>>> from cryptography.hazmat.primitives.serialization import load_pem_private_key >>> stripped_priv_key='MII<redacted>==' >>> KEY_BEGIN='-----BEGIN PRIVATE KEY-----\n' >>> KEY_END='\n-----END PRIVATE KEY-----' >>> wrapped = KEY_BEGIN + stripped_priv_key + KEY_END >>> load_pem_private_key(bytes(wrapped, 'utf-8'), password=None) Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib/python3/dist-packages/cryptography/hazmat/primitives/serialization/base.py", line 22, in load_pem_private_key return ossl.load_pem_private_key(data, password) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/cryptography/hazmat/backends/openssl/backend.py", line 921, in load_pem_private_key return self._load_key( ^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/cryptography/hazmat/backends/openssl/backend.py", line 1189, in _load_key self._handle_key_loading_error() File "/usr/lib/python3/dist-packages/cryptography/hazmat/backends/openssl/backend.py", line 1248, in _handle_key_loading_error raise ValueError( ValueError: ('Could not deserialize key data. The data may be in an incorrect format, it may be encrypted with an unsupported algorithm, or it may be an unsupported key type (e.g. EC curves with explicit parameters).', [_OpenSSLErrorWithText(code=503841036, lib=60, reason=524556, reason_text=b'error:1E08010C:DECODER routines::unsupported'), _OpenSSLErrorWithText(code=109052072, lib=13, reason=168, reason_text=b'error:068000A8:asn1 encoding routines::wrong tag'), _OpenSSLErrorWithText(code=109576458, lib=13, reason=524554, reason_text=b'error:0688010A:asn1 encoding routines::nested asn1 error'), _OpenSSLErrorWithText(code=109576458, lib=13, reason=524554, reason_text=b'error:0688010A:asn1 encoding routines::nested asn1 error')])
And again with key type...
>>> KEY_BEGIN='-----BEGIN RSA PRIVATE KEY-----\n' >>> KEY_END='\n-----END RSA PRIVATE KEY-----' >>> wrapped = KEY_BEGIN + stripped_priv_key + KEY_END >>> load_pem_private_key(bytes(wrapped, 'utf-8'), password=None) <cryptography.hazmat.backends.openssl.rsa._RSAPrivateKey object at 0x7f75aa8aaad0>