Do you mean “from the Keychain Access app”?which was previously added manually, from the keychain
The old school file-based keychain
The iOS-style keychain
And what is it doing with it? Running a TLS connection? Or are you simply using OpenSSL as a crypto toolkit?We plan to pass the extracted private key data to an openssl API.
OK, I’m going to presume you mean “because that’s what our existing OpenVPN implementation uses.” OpenVPN is a protocol and, while that protocol is based on TLS, it does not require that you to use one specific TLS implementation. Right?We need OpenSSL because we are trying to use OpenVPN protocol.
You can fight macOS to export the data in the format that you need. This is challenging on two fronts. The first is that the Security framework is reluctant to export the raw key bits of a private key. The second is that, even if can get it to do that, it probably won’t be in the format required by OpenSSL and thus you’d need to massage it after (having said that, OpenSSL is a full-featured security toolbox and thus it’s generally good at such massaging).
You can configure OpenSSL to use the system’s crypto APIs in place of its built-in crypto. I say “configure” because I’m pretty sure that folks have done this before (in fact, ISTR that Apple did this at one point).
You can disconnect your OpenVPN implementation from OpenSSL. If, for example, you layered it on top of Network framework, you’d end up using the system’s built-in TLS which can work with key objects rather than key bytes.
You are correct, that's what our existing implementation uses. Thank you for your response Quinn! We will look more into the 3 choices.OK, I’m going to presume you mean “because that’s what our existing OpenVPN implementation uses.” OpenVPN is a protocol and, while that protocol is based on TLS, it does not require that you to use one specific TLS implementation. Right?