Issues Uploading a LoTW p12 Certificate
Import fails on PHP 8.5
At least on Ubuntu 26.04 running PHP 8.5 (i.e. PHP 8.5.4 / OpenSSL 3.5.5 at the time of debugging) importing an LoTW certificate fails with the message:
Generic error extracting the private key from certificate in file N3RD.p12. For further information please visit the LoTW troubleshooting page in the Wavelog Wiki.
The logfile contains another meaningless error message:
ERROR - 2026-10-15 21:21:14 --> OpenSSL reading LoTW private key from file N3RD.p12 resulted in error: error:FFFFFFFF80000002:system library::No such file or directory
Tracing this error down to the root cause using strace and some logging lead to the openssl binary looking for two config directories being not existing on a bare Ubuntu 26.04 system:
newfstatat(AT_FDCWD, "/var/lib/crypto-config/profiles/current/openssl.conf.d", 0x7ffebc1286e0, 0) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "/etc/ssl/openssl.conf.d", 0x7ffebc1286e0, 0) = -1 ENOENT (No such file or directory)
As both fail not finding that file or directory the openssl module simply bails out. Luckily solving this is rather simple by just creating those two directories (without any further content):
sudo mkdir -p /etc/ssl/openssl.conf.d
sudo mkdir -p /var/lib/crypto-config/profiles/current/openssl.conf.d
After this the import should just work fine again. This might apply to configurations or operating systems as well. This might require a restart of the Apache web server before this solution works.
Certicates Exported from tqsl on MacOS
In some cases certificates exported from tqsl on MacOS seem to be using deprecated encryption algorithms which are not supported on recent OpenSSL versions used in Wavelog. The typical error message on a LoTW p12 certificate upload is Generic error extracting the certificate from fiel <FILENAME>.p12. If the filename contains 'key-only' this is typically a certificate request which has not been processed by LoTW yet. as shown on the following screenshot:
This can also be tested on the command line of a recent Linux system using OpenSSL:
$ openssl pkcs12 -info -in <LOTW_CERT_FILENAME>.p12
Enter Import Password:
MAC: sha1, Iteration 2048
MAC length: 20, salt length: 8
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048
Error outputting keys and certificates
40C7FEE22E760000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:../crypto/evp/evp_fetch.c:386:Global default library context, Algorithm (RC2-40-CBC : 0), Properties ()
It shows sha1 as MAC and RC2-40-CBC as encryption algorithm which both are deprecated and not supported on recent OpenSSL versions. For comparison a working certificate export would show:
$ openssl pkcs12 -info -in <LOTW_CERT_FILENAME>.p12
Enter Import Password:
MAC: sha256, Iteration 2048
MAC length: 32, salt length: 8
PKCS7 Encrypted data: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA256
Certificate bag
Bag Attributes
localKeyID: 37 A0 F5 EC 88 2A 3F F2 22 9A 8E ED 4D FC 1D 02 2A 4B BD F8
friendlyName: TrustedQSL user certificate
subject=1.3.6.1.4.1.12348.1.1 = <CALLSIGN>, CN = <NAME>, emailAddress = <EMAILADDRESS>
issuer=C = US, ST = CT, L = Newington, O = American Radio Relay League, OU = Logbook of the World, CN = Logbook of the World Production CA, DC = arrl.org, emailAddress = lotw@arrl.org
-----BEGIN CERTIFICATE-----
[...]
This shows sha256 and ARS-256-CBC which are both recent and acceptable algorithms.
To be able to upload the certificate created on MacOS with deprecated algorithms there is a simple hack: Import the broken certificate into tqsl on a recent Linux (or Windows) system and re-export it (without password) from there. This way it should now make use of the non-deprecated algorithms and import into Wavelog just fine.
Wavelog on Windows Platforms (WAMP)
There are various reasons why the upload of a LoTW p12 certificate fails. Here are a few hints that solve most issues.
If you are using Wavelog on a Windows WAMP platform you might need to configure your environment properly. In some cases the upload fails with the messge error:10000080:BIO routines::no such file like the following screenshot shows:
In this case you have to check if the OpenSSL extension is installed and activated in in your PHP configuration:
In a WAMP server (Windows) you have also to create an environment variable. But TAKE CARE WITH THE PATH OF THE FILE: It must be the path of the PHP version you are using (PHP 8.3.6 in this case):
Make sure that the path to the environment variable is correct!
If still does not work you can download and install OpenSSL for Windows from https://slproweb.com/products/Win32OpenSSL.html depending on your Windows version. You can download the light version and install it as usual.
You also have to edit the PATH variable adding a wew line with the path of openssl.exe: C:\Program Files\OpenSSL-Win64\bin
Restart your server and it should work.