open https://gitlab.synchro.net/main/sbbs/-/issues/1216

certtool --import fails with CryptLib error -43 (CRYPT_ERROR_NOTFOUND) Summary `certtool --import` fails reproducibly with a CryptLib `-43` (`CRYPT_ERROR_NOTFOUND`) error when attempting to import an external certificate/key pair into `ssl.cert`, using a correctly-formatted combined PEM file matching the format shown in the wiki's own example. Environment Synchronet version/build: 3.21e OS: Windows 11 Pro, Version 25H2 (OS Build 26200.8973) Install type: \[fresh / upgraded — fill in if known\] Steps to reproduce Obtain a valid certificate + private key + chain (in this case, from a separate successful ACME/Let's Encrypt issuance). Combine into a single PEM file in the order and format documented on the Synchronet wiki's `certtool` import example (key, cert, chain). Run `certtool --import <path-to-combined-pem>` against the running `ssl.cert`/cryptlib keyset. Observe failure. Expected result Certificate imports successfully and is installed into `ssl.cert`'s cryptlib keyset, replacing the self-signed cert. Actual result Fails with:

```
CryptLib error -43 (CRYPT_ERROR_NOTFOUND)
```

Additional notes This is not a formatting issue — the input file matches the wiki's own documented example structure. Independently corroborated by a third party: a separate sysop reported hitting the identical `-43` error against the exact same wiki example file in a November 2025 forum post, ruling out a one-off environmental cause. Happy to provide the exact combined PEM structure (redacted) or further logs on request.
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

close https://gitlab.synchro.net/main/sbbs/-/issues/1216
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/issues/1216#note_10070

Duplicate of #1111
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

https://gitlab.synchro.net/main/sbbs/-/issues/1216#note_10074

Hi Deuce,

Thanks for taking a look. I want to make sure I understand the relationship before dropping this — the two reports have different error codes and different input paths:

* #1111: CryptLib error **-22**, importing a PKCS12 container (built via `openssl` with legacy `PBE-SHA1-3DES`) using `certtool.js --import-pkcs12`
* #1216 (this one): CryptLib error **-43 (CRYPT_ERROR_NOTFOUND)**, importing a combined PEM file (key+cert+chain, matching the wiki's documented example) using plain `certtool --import`

Could you help me understand how these trace back to the same underlying cause? If it's a shared code path in cryptlib's import handling that just surfaces different error codes depending on the input format, that's good to know — I just want to make sure the PEM-import case (which seems like the more common/documented path per the wiki) isn't getting lost if it turns out to be a distinct issue.

Thanks for your time on this.
--- SBBSecho 3.37-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)