fix for macOS

app.py

@@ -122,6 +122,7 @@ def generate_cert(name):
         csr_path = os.path.join(tmpdir, "client.csr.pem")
         cert_path = os.path.join(tmpdir, "client.cert.pem")
         p12_path = os.path.join(tmpdir, "client.p12")
+        p12pw_path = os.path.join(tmpdir, "client.pw.p12")
 
         subprocess.run([
             "openssl", "req", "-config", cnf,
@@ -158,6 +159,13 @@ def generate_cert(name):
             "-passout", "pass:",
         ], check=True, capture_output=True)
 
+        subprocess.run([
+            "openssl", "pkcs12", "-export",
+            "-in", cert_path, "-inkey", key_path,
+            "-out", p12pw_path, "-name", name,
+            "-passout", "pass:0000", "-legacy",
+        ], check=True, capture_output=True)
+
         serial_out = subprocess.run(
             ["openssl", "x509", "-in", cert_path, "-serial", "-noout"],
             check=True, capture_output=True, text=True,
@@ -170,8 +178,9 @@ def generate_cert(name):
             key_pem = f.read()
         with open(p12_path, "rb") as f:
             p12_b64 = base64.b64encode(f.read()).decode()
-
-        return cert_pem, key_pem, p12_b64, serial
+        with open(p12pw_path, "rb") as f:
+            p12_pw_b64 = base64.b64encode(f.read()).decode()
+        return cert_pem, key_pem, p12_b64, p12_pw_b64, serial
     finally:
         shutil.rmtree(tmpdir)
 
@@ -191,7 +200,7 @@ def create_cert():
     if not MAC_RE.match(mac):
         return jsonify({"error": "invalid mac address"}), 400
 
-    cert_pem, key_pem, p12_b64, serial = generate_cert(name)
+    cert_pem, key_pem, p12_b64, p12_pw_b64, serial = generate_cert(name)
 
     db = get_db()
     try:
@@ -210,6 +219,7 @@ def create_cert():
         "cert_pem": cert_pem,
         "key_pem": key_pem,
         "p12": p12_b64,
+        "p12_pw": p12_pw_b64,
     }), 201
 
 
@@ -359,6 +369,8 @@ def render_page(body, **kwargs):
     "<p><strong>Serial:</strong> <code>{{ serial }}</code></p>"
     "<p><a href='data:application/x-pkcs12;base64,{{ p12 }}' "
     "download='{{ name }}.p12'>Download .p12</a></p>"
+    "<p><a href='data:application/x-pkcs12;base64,{{ p12_pw }}' "
+    "download='{{ name }}.pw.p12'>Download .p12_pw</a></p>"
     "<details><summary>PEM certificate</summary><pre>{{ cert_pem }}</pre></details>"
     "<details><summary>PEM key</summary><pre>{{ key_pem }}</pre></details>"
 )
@@ -429,7 +441,7 @@ def web_create():
         return render_page(CREATE_PAGE, name=name, mac=mac,
                            error="Invalid MAC address format.")
 
-    cert_pem, key_pem, p12_b64, serial = generate_cert(name)
+    cert_pem, key_pem, p12_b64, p12_pw_b64, serial = generate_cert(name)
 
     db = get_db()
     try:
@@ -440,7 +452,7 @@ def web_create():
         return render_page(CREATE_PAGE, name=name, mac=mac, error=str(e))
 
     return render_page(RESULT_PAGE, name=name, mac=mac, serial=serial,
-                       cert_pem=cert_pem, key_pem=key_pem, p12=p12_b64)
+                       cert_pem=cert_pem, key_pem=key_pem, p12=p12_b64, p12_pw=p12_pw_b64)
 
 
 @app.route("/edit/<name>", methods=["GET", "POST"])

create_client.sh

@@ -52,6 +52,7 @@ openssl x509 \
 
 # create pkcs12 file for windows import
 
+openssl pkcs12 -export -in "$client".cert.pem -inkey "$client".key.pem -out "$client"pw.p12 -name "$client" -passout pass:0000 -legacy
 openssl pkcs12 -export -in "$client".cert.pem -inkey "$client".key.pem -out "$client".p12 -name "$client" -passout pass:
 
 rm *.tmp