2 files changed, 5 insertions, 1 deletions
diff --git a/NEWS b/NEWS
index 75849afdfd..13f70668e7 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,10 @@ See the end for copying conditions.
 
 * Version 3.1.10 (unreleased)
 
+** certtool: When generating PKCS #12 files use by default the 
+ARCFOUR (RC4) cipher to be compatible with devices that don't
+support AES with PKCS #12.
+
 ** libgnutls-dane: Updated DANE verification options.
 
 ** API and ABI modifications:
diff --git a/src/certtool.c b/src/certtool.c
index 570c278c63..414587d860 100644
--- a/src/certtool.c
+++ b/src/certtool.c
@@ -139,7 +139,7 @@ cipher_to_flags (const char *cipher)
 {
   if (cipher == NULL)
     {
-      return GNUTLS_PKCS_USE_PBES2_AES_128;
+      return GNUTLS_PKCS_USE_PKCS12_ARCFOUR;
     }
   else if (strcasecmp (cipher, "3des") == 0)
     {