Java生成的.p12文件导入macOS钥匙串提示密码无效问题

我用BouncyCastle（BC）开发的Java应用生成了.p12文件，执行导入macOS 11钥匙串的命令：

security import mycert-personauth.p12 -k ~/Library/Keychains/login.keychain-db

输入密码后提示Sorry, you entered an invalid password，但用相同密码通过OpenSSL查看该文件完全正常：

openssl pkcs12 -in mycert-personauth.p12 -info  -nokeys -passin pass:$pw

用相同证书通过OpenSSL生成的.p12文件却能正常导入：

openssl pkcs12 -export -out ~/test1.pfx -inkey cert/mytest-personauth.key -in cert/mytest-personauth.crt -certfile ca/ca-trust.crt
security import ~/test1.pfx -k ~/Library/Keychains/login.keychain-db 
# 此处弹出GUI密码输入框
1 identity imported.
2 certificates imported.

无法导入的mycert-personauth.p12（Linux下OpenSSL 3.0.11输出） #

MAC: sha256, Iteration 10000
MAC length: 32, salt length: 20
PKCS7 Data
Shrouded Keybag: PBES2, PBKDF2, AES-256-CBC, Iteration 10000, PRF hmacWithSHA256
PKCS7 Encrypted data: PBES2, PBKDF2, AES-256-CBC, Iteration 10000, PRF hmacWithSHA256
Certificate bag
Bag Attributes
friendlyName: certandkey
localKeyID: 54 69 6D 65 20 31 37 31 37 37 31 30 30 32 33 39 38 31
subject=/DC=com/DC=contoso/CN=Users/CN=David Bowie
issuer=/DC=com/DC=contoso/CN=Contoso Issuing CA
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

Certificate bag
Bag Attributes
    friendlyName: CN=Contoso Issuing CA,DC=contoso,DC=com
subject=/DC=com/DC=contoso/CN=Contoso Issuing CA
issuer=/CN=Contoso Root CA
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

Certificate bag
Bag Attributes
    friendlyName: CN=Contoso Root CA
subject=/CN=Contoso Root CA
issuer=/CN=Contoso Root CA
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

可正常导入的test1.p12（macOS下OpenSSL输出） #

MAC Iteration 2048
MAC verified OK

PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048

Certificate bag
Bag Attributes
    localKeyID: F8 AB 55 96 23 95 4F 41 50 87 DB 98 41 DE 3A 78 50 66 2B 6D 
subject=/DC=com/DC=contoso/CN=Users/CN=David Bowie
issuer=/DC=com/DC=contoso/CN=Contoso Issuing CA
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

Certificate bag
Bag Attributes: <No Attributes>
subject=/DC=com/DC=contoso/CN=Contoso Issuing CA
issuer=/CN=Contoso Root CA
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

Certificate bag
Bag Attributes: <No Attributes>
subject=/CN=Contoso Root CA
issuer=/CN=Contoso Root CA
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048 

问题代码（简化版） #

推测问题出在Java代码中，以下是生成PKCS12的关键代码：

// keyPassword 与 keystore 密码相同
public void setPrivateKey(PrivateKey key, String alias, String keyPassword, java.security.cert.Certificate[] chain) {
   ...
   KeyStore keyStore = KeyStore.getInstance("PKCS12");
   // chain[0] 是主体证书，chain[0-N] 是CA信任链
   keyStore.setKeyEntry(alias, key, keyPassword.toCharArray(), chain);
   }

补充测试 #

将可正常导入的test1.pfx复制到Linux（OpenSSL 3.0.11）后无法处理，报错如下：

$ openssl pkcs12 -in test1.pfx -info -nokeys -passin pass:'test'
MAC: sha1, Iteration 2048
MAC length: 20, salt length: 8
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048
Error outputting keys and certificates
100000000A000000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:373:Global default library context, Algorithm (RC2-40-CBC : 0), Properties ()

内容的提问来源于stack exchange，提问作者Mike Cooper