Failed to extract certificate or private key from pfx file

[barnsta]

installed hybridCRT msi installer on windows 11 22H2 x64 but declined to install development headers. used identical command line to that used on MacOS, failed to extract certificate or private key correctly from a pfx generated by exporting a wildcard domain SSL certificate from IIS running on windows 2012 server with export-private-key enabled.

d:\tmp>openssl pkcs12 -in c2.pfx -clcerts -nokeys -out syn.crt
Enter Import Password:

Error outputting keys and certificates
640C0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto\evp\evp_fetch.c:376:Global default library context, Algorithm (RC2-40-CBC : 0), Properties (<null>)
640C0000:error:030000A0:digital envelope routines:EVP_PBE_CipherInit_ex:unknown cipher:crypto\evp\evp_pbe.c:127:RC2-40-CBC

d:\tmp>openssl pkcs12 -in c2.pfx -nocerts -out synenc.key
Enter Import Password:

Enter PEM pass phrase:

Verifying - Enter PEM pass phrase:

Error outputting keys and certificates
2C170000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto\evp\evp_fetch.c:376:Global default library context, Algorithm (RC2-40-CBC : 0), Properties (<null>)
2C170000:error:030000A0:digital envelope routines:EVP_PBE_CipherInit_ex:unknown cipher:crypto\evp\evp_pbe.c:127:RC2-40-CBC

[nhorman]

where did you download the installer from?

[barnsta]

https://github.com/openssl/installer/releases/download/testing_release/OpenSSL-x64-hybridCRT-4.0.1.msi

[FdaSilvaYY]

Are you using the same OpenSSL version on both case ?

Possible explanation:

https://stackoverflow.com/questions/72598983/ddg#72600724

I hit this case while implementing FIPS, who disallow RC2-40-CBC

[barnsta]

I unselected the FIPS option during installation, and the version on MacOS is 3.3.6 LibreSSL. I think the stackoverflow link applies to pre 3.x.x versions of SSL ?

[nhorman]

I think the problem is that RC2-40-CBC is a legacy algorithm, and your command line doesn't load the legacy provider (I imagine your macos install has a config that loads it by default). Try this command line:

openssl.exe pkcs12 -provider=legacy -propquery "?provider=legacy" -in c2.pfx -clcerts -nokeys -out syn.crt