Converting PKCS#8 into PKCS#1 fails with openssl 3.0

[jean-christophe manciot]

On Ubuntu jammy
with OpenSSL 3.0.2:

$ openssl rsa -in rsakey.pkcs8 -out rsakey.pkcs1
writing RSA key

$ grep -- "-----BEGIN" rsakey.pkcs1
-----BEGIN PRIVATE KEY-----

With OpenSSL 1.1.1o or 1.1.1l
$ openssl rsa -in rsakey.pkcs8 -out rsakey.pkcs1
writing RSA key

$ grep -- "-----BEGIN" rsakey.pkcs1
-----BEGIN RSA PRIVATE KEY-----

Unfortunately, we still need to be able to generate PKCS #1 private keys as mysqld (8.0.29-0ubuntu0.22.04.2) despite using libssl3 is still not capable of loading PKCS #8 private keys.

[Simon Chopin (schopin)]

Hi!

You want to add -traditional to your openssl rsa command to get the previous behaviour:

❯ openssl rsa -in key.pem | grep BEGIN
writing RSA key
-----BEGIN PRIVATE KEY-----

❯ openssl rsa -in key.pem -traditional | grep BEGIN
writing RSA key
-----BEGIN RSA PRIVATE KEY-----