Express Can Use .pfx file with encrypted private key without the private key's password

Question

I have an express instance and an unencrypted pfx which contains my cert and an encrypted private key. When I load the pfx in express, I do not need to provide any sort of password, and it works. How is the node.js instance getting access to the private key? Isnt access to the unencrypted private key needed for https to work?

express code:

var httpsOptions = {
    'pfx': fs.readfileSync('./cert.pfx'),
    'passphrase': ''
};

https.createServer(httpsOptions, expressApp).listen(443, 'example.com');

My .pfx info from openSSL looks like the following:

openssl pkcs12 -in cert.pfx -info
MAC Iteration 2048
MAC verified OK
PKCS7 Encrypted data: XXXXXXXXXXXX, Iteration 2048
Certificate bag
Bag Attributes
    localKeyID: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX
subject=/OU=Domain Control Validated/CN=*.example.com
issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, 
Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure 
Certificate Authority - G2
-----BEGIN CERTIFICATE-----
XXXXXXXXXXX=
-----END CERTIFICATE-----
PKCS7 Data 
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048
Bag Attributes
    localKeyID: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX
Key Attributes: <No Attributes>
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,XXXXXXXXXXX

XXXXXXXXXXXXXXXX==
-----END RSA PRIVATE KEY-----

score 1 · Accepted Answer · answered Oct 27 '17 at 19:09

Turns out both the pfx itself and the private key within the pfx were stored unencrypted.

I mistakenly thought the private key within the pfx was encrypted because 1.) I was told it was and 2.) and because the openSSL package will not display the raw private key unless explicitly told to with the -nodes option

when openssl displays Enter PEM pass phrase: as it did above, it was asking for how to encrypt the displayed output: not how to decrypt the stored key, as I originally thought

The correct command I was looking for above was

openssl pkcs12 -in cert.pfx -info -nodes

Express Can Use .pfx file with encrypted private key without the private key's password

1 Answers1