I am attempting to import a PFX/P12 certificate generated by the Windows certificate manager for use with S/MIME into MacOS Catalina Keychain. The certificate is encrypted with AES256.
The same certificate and password work correctly when encrypted with 3DES.
When the certificated uses AES256, Keychain complains "MAC verification failed during PKCS12 import" after I enter the password. The same error is achieved using the
Any ideas what might be wrong?
CLI examples that did not work:
security import ./foo.pfx -f pkcs12 security import ./foo.pfx -t cert -f pkcs12 security import ./foo.pfx -f pkcs12 -k ~/Library/Keychains/login.keychain security import ./foo.pfx -f pkcs12 -T /usr/bin/codesign -k ~/Library/Keychains/login.keychain
Update 1: How the Certificates were Created
- Login with my user on a Windows 10 desktop
- Open Manager User Certificates
- Personal -> Certificates -> All Tasks -> Request New Certificate
- Select the appropriate enrollment policy
- Right click the certificate and choose "Export..."
- Select the format:
- include all certificates
- enable certificate privacy
- Set the password
At some point in the process I chose AES256 or 3DES from a drop down (only two options available)