tlscommon: fix EC key decryption

[AndersonQ]

What does this PR do?

Fix how encrypted TLS certificate keys are handled. x509.DecryptPEMBlock returns a PEM block, and the code would assume it was not in PEM format and was re-encoding it into PEM, which would generate an invalid key.

Why is it important?

Without the fix, it breaks when parsing a certificate key

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have added tests that prove my fix is effective or that my feature works

Author's Checklist

• [ ]

Related issues

• Relates Load fleet.ssl.certificate_authorities from agent policy elastic-agent#2247
• Relates Load fleet.ssl.certificate and fleet.ssl.key from agent policy elastic-agent#2248

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: 4c2d07c

Failed CI Steps

• :linux: Test Linux
• :windows: Test Windows
• :mac: Test MacOS
• :junit: Junit annotate

History

cc @AndersonQ

[cmacknz]

Needs a test

[leehinman]

needs tests

[leehinman]

Is this function only used for reading PEM encoded private keys? The implementation suggests that, but the function name and signature don't. If this were to read a PEM encoded certificate, you don't want to re-encode.

As it stands, I think the default case is trying to catch if they actually supplied a DER encoded private key. If that is the case it is probably worth checking to see if ParsePKIXPublicKey works and to log at the warn level that DER format was provided but PEM format was expected.

[AndersonQ]

x509.DecryptPEMBlock should receive a DER encoded key, not a PEM encoded. That way the key it returns will always be in DER format and we need to encode it as PEM. Thus the code is actually correct