MySQL Bugs: #63732: PFX file works on XP, but not on 7

Bug #63732	PFX file works on XP, but not on 7
Submitted:	13 Dec 2011 13:04	Modified:	14 Dec 2011 20:25
Reporter:	Issac Goldstand	Email Updates:
Status:	Not a Bug	Impact on me:	None
Category:	Connector / NET	Severity:	S3 (Non-critical)
Version:	6.4.4	OS:	Windows (Windows 7)
Assigned to:		CPU Architecture:	Any
Tags:	SSL

Description:
When attempting to connect to an SSL-enabled server using SSL=Required (or above), I consistently get the message "The credentials specified to the package were not recognized" from windows 7, but the same code works under WinXP

This seems to be related to using the export password "1", which is getting interpreted differently, somehow, on Windows 7

How to repeat:
Create a .pfx file with export password "1" (w/o quotes) and attempt to connect from XP / 7

Suggested fix:
Either warn against this (if it's indeed a problem) in the docs, or fix it

After some investigation, it seems the file password isn't the problem.

After building the connector from source, I can see that GetClientCertificates() is able to read the file just fine (at least I can see something that looks correct in clientCert - it has the correct subject, the correct issuer, and has a private key) - something is causing the problem inside ss.AuthenticateAsClient (which I don't know how to step into further - or even if this is possible)

Another update - hasPrivateKey is true but the private key is empty, so the problem seems to be in the constructor for X509Certificate2 object.

I'm not enough of a PKCS#12 expert, but if it can read the publickey, does that not mean that the private key is also readable?

The .p12 was generated via openssl pkcs12 -export  -in crt.pem -inkey key.pem -out mysql.p12

After further investigation, it seems to be  a quirk of the specific keypair I'm working with.  Fresh keypairs don't exhibit the same behavior (although I still haven;t gotten a connection yet)