title: Generating a pem file from p12 in FIPS enabled OS
body: <p>Our application includes a script which converts p12 to pem format. Operating System is RHEL 7 FIPS enabled and it's using OpenSSL 1.0.2k-fips library.Script fails with the below error during this pem conversion. Tried few algorithms other than RC2-40 and it's still a failure, trying to find the right flags to pass in the openssl command for making this pem conversion successful, any suggestions:</p>
  
  <p><strong>Command :</strong></p>
  
  <pre><code>openssl pkcs12 -in app1-serverpub.p12 -certpbe pbeWithSHA1And3-KeyTripleDES-CBC -keypbe pbeWithSHA1And3-KeyTripleDES-CBC -out ca-bundle.pem -passin pass:xxxx -info
  </code></pre>
  
  <p><strong>Error :</strong></p>
  
  <pre><code>MAC Iteration 100000  
  MAC verified OK  
  PKCS7 Encrypted data: `pbeWithSHA1And40BitRC2-CBC`, Iteration 50000  
  Error outputting keys and certificates  
  139990890305424:error:060740A0:digital envelope routines:EVP_PBE_CipherInit:unknown cipher:evp_pbe.c:181:  
  139990890305424:error:23077073:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 algor cipherinit error:p12_decr.c:87: 
  139990890305424:error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error:p12_decr.c:139:
  </code></pre>
  
  <p>========================================================================</p>
  
  <p>Tried the below command per various suggestions, still not able to override this error :  </p>
  
  <p><code>openssl pkcs12 -in app1-serverpub.p12 -out ca-bundle.pem -passin pass:xxxx  -descert -info</code><br>
  PKCS7 Encrypted data: <code>pbeWithSHA1And40BitRC2-CBC</code>, Iteration 50000 </p>
  
  <ol>
  <li>Please suggest right algorithm/correct values to try for certpbe, keypbe</li>
  <li>openssl command to use any algorithm which overrides RC2-40 which is not FIPS complaint</li>
  </ol>
  
  <p>Thanks.</p>