Getting OpenSSL::X509::CertificateError nested asn1 error on Ruby

Question

I have .p12 file from Apple and tried to convert it to .pem file with following command:

openssl pkcs12 -in cert.p12 -out apple_push_notification_development.pem -nodes -clcerts

When trying the create new OpenSSL::X509::Certificate object with

OpenSSL::X509::Certificate.new(File.read('apple_push_notification_development.pem'))

I get the following error:

OpenSSL::X509::CertificateError: nested asn1 error
    from (irb):9:in `initialize'
    from (irb):9:in `new'
    ...

Did I do something wrong ? Being stuck, please help. Thanks

Answer 1

Appreciate it's not your exact same scenario, but I was attempting to read in a PEM file (PKCS7) in my instance. OpenSSL CLI would decode it fine, but ruby kept throwing the same nested asn1 error that you describe when I tried to load it into an object.

In my case it needed a new line i.e. '\n' at the end of the PEM file for it to accept it.

I worked it out only when I created an empty object and compared the generated PEM output to the file I was trying to load.

So with a X509 cert maybe try:

cert = OpenSSL::X509::Certificate.new
cert.to_pem
=> "-----BEGIN CERTIFICATE-----\nMCUwGwIAMAMGAQAwADAEHwAfADAAMAgwAwYBAAMBADADBgEAAwEA\n-----END CERTIFICATE-----\n"

And compare it to your PEM file

As you can see it's terminated with a new line and that was missing in the file that I was trying to import.

Answer 2

I've had the same problem and im my case I needed to decode file content with Base64.

require 'openssl'
require 'base64'

encoded_content = File.read('apple_push_notification_development.pem')
decoded_content = Base64.decode64(encoded_content)
certificate = OpenSSL::X509::Certificate.new(decoded_content)