title: Client certificate problems with Net::HTTP (Neither PUB key nor PRIV key:: nested asn1 error)
body: <p>I'm in the process of testing a system using Cucumber, part of which involves authenticating on a remote .NET server using an SSL client certificate. The developer of this .NET system has provided me with this certificate in the form of a .pem file which looks like this:</p>
  
  <pre><code>    -----BEGIN CERTIFICATE-----
      MIIFzTCCBLWgAwIBAgIKHNfvKAAAAAAAFDANBgkqhkiG9w0BAQUFADBKMRMwEQYK
      ...more lines...
      aaG0c6enKQJiVcA4myLkBkN/wxiZsnBy/zGdj+u4RurxcS717FKm7oYY3JsuRSRH
      Ow==
      -----END CERTIFICATE-----
  </code></pre>
  
  <p>The code I'm using to connect looks something like this (taken from <a href="http://www.rubyinside.com/nethttp-cheat-sheet-2940.html" rel="nofollow noreferrer">http://www.rubyinside.com/nethttp-cheat-sheet-2940.html</a>):</p>
  
  <pre><code>    uri = URI.parse("https://secure.com/")
      pem = File.read("/path/to/my.pem")
      http = Net::HTTP.new(uri.host, uri.port)
      http.use_ssl = true
      http.cert = OpenSSL::X509::Certificate.new(pem)
      http.key = OpenSSL::PKey::RSA.new(pem)
      http.verify_mode = OpenSSL::SSL::VERIFY_NONE
  
      request = Net::HTTP::Get.new(uri.request_uri)
  </code></pre>
  
  <p>However, the line 'http.key = OpenSSL::PKey::RSA.new(pem)' raises the following exception:</p>
  
  <pre><code>    Neither PUB key nor PRIV key:: nested asn1 error (OpenSSL::PKey::RSAError)
  </code></pre>
  
  <p>I was originally using HTTParty to make the request but had the same problem which I traced to basically the same line within HTTParty itself.</p>
  
  <p>It appears that this certificate I've been given can happily be passed into OpenSSL::X509::Certificate.new to create a certificate object, but it can't be used to create an instance of OpenSSL::PKey::RSA. I've tried removing the line that sets the key, but then the authentication fails. It's possible that this is in fact what I should be doing and that the authentication is failing for some other reason, but I need a clearer idea as to what is going on here before I start digging for problems elsewhere.</p>
  
  <p>From this SO question: <a href="https://stackoverflow.com/questions/2293608/what-causes-neither-pub-key-nor-priv-key-nested-asn1-error-when-building-a-p">What causes &quot;Neither PUB key nor PRIV key:: nested asn1 error&quot; when building a public key in ruby?</a>
  ... it appears as though a private key should somehow be included in the pem file, but the .NET developers seem to think that this isn't necessary.</p>
  
  <p>Pinning down the .NET developers to get a clear idea as to how exactly their authentication works is proving difficult and I can't seem to find clear info online either. Can anyone shed any light on this?</p>