Convert PEM private keys and certificates into a cryptlib PKCS#15 keyset for Mystic. Based on amenonsen/pemtrans; its explicit permission is in the C header.
Status: Converter adaptation in development; not qualified for production certificates.
A small native program for Linux and Windows, supporting old cryptlib 3.4.5 and the newer library through explicitly checked API profiles. Library/keyset formats must not be guessed from filename extensions.
Planned checks include key/certificate matching, chain handling, protected password input and reopening the output with the target library. Existing certificates are not automatically replaced and production services are not restarted. Algorithm support and native Mystic handshakes require separate qualification.
Planned distribution contains one executable and README.txt: ZIP for Windows, tar.gz for Linux. No separate manpage, MSI/DEB or system-wide PATH change.
The first preview is published.
Each archive contains only the executable and README. Native Windows 10 x86/x64 conversion tests with cryptlib 3.4.5 and Linux amd64 tests with 3.4.5/3.4.9.6 passed, including fullchain, encrypted PKCS#8 input, automatic library discovery and overwrite protection. Other Linux architectures passed startup tests on Debian 12/13 and Ubuntu 24.04/26.04. i386 uses 32-bit libraries on an amd64 kernel for these tests. Native Linux Mystic A49 BinkP TLS 1.2 with cryptlib 3.4.5 passed: exact converted leaf, CA/hostname checks, encrypted BinkP framing and unchanged keyset. Other native Mystic protocol/platform combinations require separate qualification.
Preview 2 fixes the minimum-length check for A49's short fixed native keyset password; preview 1 was incompatible with it. Password files remain protected and their contents are not printed.