certtool: --pkcs-cipher option not working

[Timo Gerke]

Hi all,

I'm new to this list, so I hope this report can help you to figure out
my problem.

when I generate a private key (DSA) with certtool, e. g.
    certtool -p --dsa --pkcs-cipher aes-256 --outfile privkey.pem

The key won't get encyrpted.

If I use
    certtool -p --pkcs8 --dsa --pkcs-cipher aes-256 --outfile privkey.pem
I get following output:
Generating a 2048 bit DSA private key...
Enter password:
Confirm password:
|<1>| Selecting default encryption PKCS12_3DES_SHA1 (flags: 2).

I tried with gnutls 2.9.10 to 2.10.0.
Now I'm wondering why the key is encrypted with 3des and not aes-256
(which I specified).

Regards,
Timo Gerke