Confirmed with 1.0.2h on Windows 10 64-bit and 1.0.2g-fips on Xubuntu Linux (16.04 'Xenial Xerus')
Make new RSA key in PKCS#8 format: ~$ openssl genpkey -algorithm rsa -out rsa_new.key Try an example from the man page for 'pkcs8' to convert to (old) traditional format: ~$ openssl pkcs8 -in rsa_new.key -out rsa_old.key Error reading key 139801503176344:error:0906D06C:PEM routines:PEM_read_bio:no start line: pem_lib.c:701:Expecting: ENCRYPTED PRIVATE KEY Read docs to find switch for making pkcs8 accept unencrypted keys. Try again: ~$ openssl pkcs8 -nocrypt -in rsa_new.key -out rsa_old.key Check contents of new format and old format files: ~$ head -n 3 rsa_new.key rsa_old.key ==> rsa_new.key <== -----BEGIN PRIVATE KEY----- MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBAL93XnIDaTAl3MS7 4OluxTGCG8yjI1MCQQz1dBvVf9Q1qeiqGTekY94Cj2KaHgF1EPOjKRgSG7ag7s9J ==> rsa_old.key <== -----BEGIN PRIVATE KEY----- MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBAL93XnIDaTAl3MS7 4OluxTGCG8yjI1MCQQz1dBvVf9Q1qeiqGTekY94Cj2KaHgF1EPOjKRgSG7ag7s9J The key is untranslated. This is a direct contradiction to the documentation. The docs even have a nearly identical example: >Convert a private key from any PKCS#8 format to traditional format: > > openssl pkcs8 -in pk8.pem -out key.pem Workaround - use 'openssl rsa': ~$ openssl rsa -in rsa_new.key -out rsa_old.key writing RSA key ~$ head -n 3 rsa_new.key rsa_old.key ==> rsa_new.key <== -----BEGIN PRIVATE KEY----- MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBAL93XnIDaTAl3MS7 4OluxTGCG8yjI1MCQQz1dBvVf9Q1qeiqGTekY94Cj2KaHgF1EPOjKRgSG7ag7s9J ==> rsa_old.key <== -----BEGIN RSA PRIVATE KEY----- MIICWwIBAAKBgQC/d15yA2kwJdzEu+DpbsUxghvMoyNTAkEM9XQb1X/UNanoqhk3 pGPeAo9imh4BdRDzoykYEhu2oO7PSYAkoqD1mj+C+yCrx6aEOqehGXm/y3rxHTH9 I'm glad I was able to get the desired result with the workaround, but the pkcs8 command does not work as advertised. I tried it with encrypted keys and got the same result that way as well. -- Ticket here: http://rt.openssl.org/Ticket/Display.html?id=4544 Please log in as guest with password guest if prompted -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
