https://bugs.kde.org/show_bug.cgi?id=527463
Bug ID: 527463
Summary: Save stays disabled when the correct password for an
encrypted EC private key is entered (RSA works)
Classification: Plasma
Product: plasmashell
Version First 6.8.0
Reported In:
Platform: unspecified
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: Networking in general
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: 1.0
DESCRIPTION
In the Wi-Fi connection editor (WPA2/WPA3 Enterprise, TLS), the Save button
stays disabled when the correct password for an encrypted EC private key is
entered. It is disabled with an empty password field, becomes enabled when an
incorrect or partial password is typed, and becomes disabled again when the
correct password is entered. With an RSA key and the same password, Save is
enabled as expected.
Disclaimer: This text was formatted using an LLM because of my limited English.
The testing and the observations were done and verified by a real person.
STEPS TO REPRODUCE
No real network or Wi-Fi hardware is needed.
1. Generate test files (self-signed, so no separate CA is needed):
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -keyout
ec-key.pem -out ec-cert.pem -days 1 -subj "/CN=test" -passout pass:123456
openssl req -x509 -newkey rsa:2048 -keyout rsa-key.pem -out rsa-cert.pem
-days 1 -subj "/CN=test" -passout pass:123456
2. System Settings -> Wi-Fi & Networking -> "+" -> Wi-Fi. Set any SSID,
Security: WPA2/WPA3 Enterprise, Authentication: TLS, any Identity and Domain.
3. User certificate: ec-cert.pem
CA certificate: ec-cert.pem (the same file; any PEM certificate works)
Private key: ec-key.pem
Private key password: 123456
Optional (not required, the result is the same): separate CA and CA-signed
client certificate:
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes
-keyout ca-key.pem -out ca.crt -days 1 -subj "/CN=test-ca"
openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -keyout
ec-key.pem -out ec.csr -subj "/CN=test" -passout pass:123456
openssl x509 -req -in ec.csr -CA ca.crt -CAkey ca-key.pem -CAcreateserial
-days 1 -out ec-cert.pem
Then use ca.crt as CA certificate in step 3.
OBSERVED RESULT
Save is disabled while the password field is empty, becomes enabled as soon as
a wrong or partial password is typed, and becomes disabled again when the
correct password is entered.
EXPECTED RESULT
Save is enabled once all fields are valid, including when the correct key
password is entered.
SOFTWARE/OS VERSIONS
1) openSUSE Tumbleweed 20261017 (Real desktop)
KDE Plasma Version: 6.8.0
KDE Frameworks Version: 6.31.0
Qt Version: 6.11.2
NetworkManager 1.58.1, openssl 3.5.3
2) KDE neon (live session, not installed / vm)
KDE Plasma Version: 6.8.0
KDE Frameworks Version: 6.31.0
Qt Version: 6.11.1
NetworkManager 1.46.0-1ubuntu2.8, openssl 3.0.13
Same behavior as on Tumbleweed, despite the much older NetworkManager.
ADDITIONAL INFORMATION
- Repeating step 3 with rsa-cert.pem / rsa-key.pem and the same password: Save
is enabled as expected.
- Reproduced with curves secp384r1 and prime256v1, and with the EC key
converted to traditional format (BEGIN EC PRIVATE KEY).
- Reproduced on openSUSE Tumbleweed and KDE neon, so it is not specific to one
distribution's packaging.
- Same behavior when editing an existing connection, and in the connect dialog
opened from the Networks widget for a scanned Enterprise network.
- The same EC key, certificate and password are accepted by
nm-connection-editor (GTK): Save is enabled there. So the key is valid for
libnm and the problem appears specific to the plasma-nm dialog's validation.
- Setting a .p12 file directly as both user certificate and private key works,
and configuring the same profile with nmcli works too.
--
You are receiving this mail because:
You are watching all bug changes.
