From 9dd83703ff02e7464361e3b34109ad1354804e9d Mon Sep 17 00:00:00 2001
From: "sourabh.sarupria" <sourabh.sarupria@choicehotels.com>
Date: Mon, 6 Apr 2026 15:16:54 -0700
Subject: [PATCH] Fix import of certificates with ECC private keys

The upload form's frontend validation regex only accepted PKCS8
("BEGIN PRIVATE KEY") and traditional RSA ("BEGIN RSA PRIVATE KEY")
formats, rejecting EC private keys ("BEGIN EC PRIVATE KEY") and
keys prefixed with EC PARAMETERS (as produced by openssl ecparam
-genkey).

Changes:
- Update ng-pattern in upload.tpl.html to accept EC PRIVATE KEY
  format, with optional EC PARAMETERS prefix
- Add defensive stripping of EC PARAMETERS block in
  parse_private_key() for compatibility with older cryptography
  versions
- Add test for parsing EC keys with EC PARAMETERS prefix

Closes #5058

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 lemur/common/utils.py                              | 14 ++++++++++++++
 .../certificates/certificate/upload.tpl.html       |  2 +-
 lemur/tests/test_validators.py                     | 13 +++++++++++++
 3 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/lemur/common/utils.py b/lemur/common/utils.py
index b75dc817d4..d526b6eb72 100644
--- a/lemur/common/utils.py
+++ b/lemur/common/utils.py
@@ -90,12 +90,26 @@ def parse_private_key(private_key):
     """
     Parses a PEM-format private key (RSA, DSA, ECDSA or any other supported algorithm).
 
+    Strips any EC PARAMETERS block that may precede EC private keys (e.g. from
+    ``openssl ecparam -genkey``), since some cryptography versions cannot parse
+    a PEM bundle containing both sections.
+
     Raises ValueError for an invalid string. Raises AssertionError when passed value is not str-type.
 
     :param private_key: String containing PEM private key
     """
     assert isinstance(private_key, str)
 
+    # Strip EC PARAMETERS block if present (produced by openssl ecparam -genkey)
+    if "-----BEGIN EC PARAMETERS-----" in private_key:
+        import re
+        private_key = re.sub(
+            r"-----BEGIN EC PARAMETERS-----.*?-----END EC PARAMETERS-----\s*",
+            "",
+            private_key,
+            flags=re.DOTALL,
+        )
+
     return load_pem_private_key(
         private_key.encode("utf8"), password=None, backend=default_backend()
     )
diff --git a/lemur/static/app/angular/certificates/certificate/upload.tpl.html b/lemur/static/app/angular/certificates/certificate/upload.tpl.html
index bf897a6088..fca24cd803 100644
--- a/lemur/static/app/angular/certificates/certificate/upload.tpl.html
+++ b/lemur/static/app/angular/certificates/certificate/upload.tpl.html
@@ -56,7 +56,7 @@ <h3 class="modal-title">Import a certificate <span class="text-muted"><small>enc
       <div class="col-sm-10">
                 <textarea name="privateKey" ng-model="certificate.privateKey" placeholder="PEM encoded string..."
                           class="form-control"
-                          ng-pattern="/(^-----BEGIN PRIVATE KEY-----[\S\s]*-----END PRIVATE KEY-----)|(^-----BEGIN RSA PRIVATE KEY-----[\S\s]*-----END RSA PRIVATE KEY-----)/"></textarea>
+                          ng-pattern="/(^(-----BEGIN EC PARAMETERS-----[\S\s]*-----END EC PARAMETERS-----\s*)?-----BEGIN (RSA |EC )?PRIVATE KEY-----[\S\s]*-----END (RSA |EC )?PRIVATE KEY-----)/"></textarea>
 
         <p ng-show="uploadForm.privateKey.$invalid && !uploadForm.privateKey.$pristine" class="help-block">Enter
           a valid certificate.</p>
diff --git a/lemur/tests/test_validators.py b/lemur/tests/test_validators.py
index 77148079d9..a55b83c4e1 100644
--- a/lemur/tests/test_validators.py
+++ b/lemur/tests/test_validators.py
@@ -15,6 +15,19 @@ def test_private_key(session):
         parse_private_key("invalid_private_key")
 
 
+def test_parse_ec_private_key_with_parameters(session):
+    """Verify that EC keys with an EC PARAMETERS prefix can be parsed (issue #5058)."""
+    import subprocess
+    result = subprocess.run(
+        ["openssl", "ecparam", "-genkey", "-name", "secp384r1"],
+        capture_output=True, text=True,
+    )
+    ec_key_with_params = result.stdout
+    assert "BEGIN EC PARAMETERS" in ec_key_with_params
+    key = parse_private_key(ec_key_with_params)
+    assert key is not None
+
+
 def test_validate_private_key(session):
     key = parse_private_key(SAN_CERT_KEY)