pyhanko.pdf_utils.config_utils.ConfigurationError: Error while loading key material

[OttomanZ]

Describe the bug
I have a cert.pem and a key.pem file generated using openssl rsa:1024 from the following command, but when I go ahead and try to sign a pdf using the files pyhanko gives me the following error.

(AutoSign) PS C:\Users\munee\Desktop\AutoSign> pyhanko sign addsig pemder .\dummy.pdf out.pdf --key .\hostkey.pem --cert .\hostcert.pem     
Key passphrase: 
2022-09-07 18:26:37,319 - pyhanko.sign.signers.pdf_cms - ERROR - Could not load cryptographic material
Traceback (most recent call last):
  File "C:\Users\munee\AppData\Local\Programs\Python\Python39\lib\runpy.py", line 197, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "C:\Users\munee\AppData\Local\Programs\Python\Python39\lib\runpy.py", line 87, in _run_code
    exec(code, run_globals)
  File "C:\Users\munee\Desktop\AutoSign\Scripts\pyhanko.exe\__main__.py", line 7, in <module>
  File "c:\users\munee\desktop\autosign\lib\site-packages\pyhanko\__main__.py", line 7, in launch
    cli(prog_name='pyhanko')
  File "c:\users\munee\desktop\autosign\lib\site-packages\click\core.py", line 1130, in __call__
    return self.main(*args, **kwargs)
  File "c:\users\munee\desktop\autosign\lib\site-packages\click\core.py", line 1055, in main
    rv = self.invoke(ctx)
  File "c:\users\munee\desktop\autosign\lib\site-packages\click\core.py", line 1657, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "c:\users\munee\desktop\autosign\lib\site-packages\click\core.py", line 1657, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "c:\users\munee\desktop\autosign\lib\site-packages\click\core.py", line 1657, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "c:\users\munee\desktop\autosign\lib\site-packages\click\core.py", line 1404, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "c:\users\munee\desktop\autosign\lib\site-packages\click\core.py", line 760, in invoke
    return __callback(*args, **kwargs)
  File "c:\users\munee\desktop\autosign\lib\site-packages\click\decorators.py", line 26, in new_func
    return f(get_current_context(), *args, **kwargs)
  File "c:\users\munee\desktop\autosign\lib\site-packages\pyhanko\cli.py", line 958, in addsig_pemder
    signer = pemder_config.instantiate(provided_key_passphrase=passphrase)
  File "c:\users\munee\desktop\autosign\lib\site-packages\pyhanko\config.py", line 369, in instantiate
    raise ConfigurationError("Error while loading key material")
pyhanko.pdf_utils.config_utils.ConfigurationError: Error while loading key material

To Reproduce
Steps to reproduce the behavior:

Generating the OpenSSL Certificate

(AutoSign) PS C:\Users\munee\Desktop\AutoSign> .\openssl\openssl req -config .\openssl\openssl.cnf -x509 -days 365 -newkey rsa:1024 -keyout 
hostkey.pem -nodes -out hostcert.pem -subj "/C=GB/ST=London/L=London/O=Global Security/OU=IT Department/CN=example.com"

Running PyHanko to Sign the PDF file,

(AutoSign) PS C:\Users\munee\Desktop\AutoSign> pyhanko sign addsig pemder .\dummy.pdf out.pdf --key .\hostkey.pem --cert .\hostcert.pem     
Key passphrase: 

I do not understand what this Key Passphrase means but whether I leave it empty or type something it gives me the above error.
Expected behavior

It should Produce a Proper Signed PDF.
Screenshots
If applicable, add screenshots to help explain your problem.

Environment (please complete the following information):

• OS: Windows 10 21H2
• Python: 3.9

Additional context
Add any other context about the problem here.

[OttomanZ]

@MatthiasValvekens @maycuatroi

[MatthiasValvekens]

(moved to discussions as this is not a bug in pyHanko)

Hi @OttomanZ,

You're signing with an unencrypted private key file. If you want to do that from the CLI, use the --no-pass option on the command line.

Also, 1024-bit RSA is no longer considered secure, just as an FYI. Having said that, self-signed certificates typically aren't all that useful either, so if it's just for testing: go ahead. :)

[MatthiasValvekens]

I've added a warning to the CLI when the passphrase is left empty, just to make --no-pass a little more discoverable.

[OttomanZ]

Thanks.