An application owner at my organization requested a java keystore to be built around specific parameters and provide them with both the JKS and pkcs12 versions of the keystore. Weeks later and after many changes they were troubleshooting some issues. The application admin, not thinking of the security implications, blasts an email with the output of the OpenSSL command: pkcs12 -info -in .
In the output of that command the first key listed shows.
-----BEGIN ENCRYPTED PRIVATE KEY-----
blahblahblahblahblah
-----END ENCRYPTED PRIVATE KEY-----
To me this looks nuclear and appears to expose the private key. My recommendation initially is to burn the entire keystore and start over rekeying everything. As this is a significant amount of work I wanted to be sure my reaction was accurate. It does say Encrypted so perhaps as long as the password is still secure maybe we're okay? I'm pretty solid on OpenSSL and keytool but this slips past my expertise. Can anyone here help me define the exposure for my mangement?