Cannot read password from powershell and give it to openssl

Question

I'm trying to give a password to openssl from powershell :

PS>$pfxFile = "toto.pfx"
PS>$ext= ls $pfxFile | % Extension
PS>$pwd = Read-Host "Enter Import Password" -AsSecureString
PS>$env:pwd = $pwd
PS>openssl pkcs12 -nokeys  -nodes -in $pfxFile -out $pfxFile.replace( $ext , "-FULL.pem" ) -passin env:pwd
Mac verify error: invalid password?
PS>

I've tried casting the pwd variable to string but it does not work either :

PS>$pfxFile = "toto.pfx"
PS>$ext= ls $pfxFile | % Extension
PS>$pwd = Read-Host "Enter Import Password" -AsSecureString
PS>$pwd
System.Security.SecureString
PS>$env:pwd = [string]$pwd
PS>openssl pkcs12 -nokeys  -nodes -in $pfxFile -out $pfxFile.replace( $ext , "-FULL.pem" ) -passin env:pwd
Mac verify error: invalid password?
PS>

How can I make this work ?

Mathias R. Jessen · Accepted Answer · 2025-07-31 14:07:47Z

A SecureString is not really the same as a regular string - it's a data structure that intentionally obscures the string contents in memory to make it harder to accidentally leak secrets to disk during a memory dump for example.

You can either materialize the underlying string contents and read it back like so:

$passwd = Read-Host "Enter Import Password" -AsSecureString

try {
  $secureStringPtr = [System.Runtime.InteropServices.Marshal]::SecureStringToCoTaskMemUnicode($passwd)
  $cleartextPasswd = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($secureStringPtr)
}
finally {
  [System.Runtime.InteropServices.Marshal]::ZeroFreeCoTaskMemUnicode($secureStringPtr)
}

... or you can offload it to PSCredential.GetNetworkCredential() - the resulting network credential object will expose the password in clear text:

$cleartextPasswd = [pscredential]::new('dummyusername', $passwd).GetNetworkCredential().Password

$cleartextPasswd will now contain a regular string with the contents input to Read-Host, which you can then pass to openssl

mklement0 · Accepted Answer · 2025-07-31 22:22:44Z

2

To offer a PowerShell (Core) 7-only alternative to Mathias' helpful answer:

In PowerShell 7, Read-Host now has a -MaskInput switch, which - like -AsSecureString - masks the characters being typed by the user with * characters, but - unlike -AsSecureString - outputs what the user typed as-is, as a regular, plain-text string.

# PowerShell 7 only
# -MaskInput masks what is being typed interactively, 
# but returns what was typed as-is.
$pwd = Read-Host "Enter Import Password" -MaskInput

Perhaps needless to say, using plain-text passwords is best avoided, but that's not always an option.

edited Jul 31 at 22:22

answered Jul 31 at 14:48

mklement0

452k68 gold badges728 silver badges988 bronze badges

Collectives™ on Stack Overflow

Cannot read password from powershell and give it to openssl

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related