How to convert PFX to separate .key/.crt file2 min read

Praseeb K Das
Praseeb K Das Author
Devops Engineer
Sorry! The Author has not filled his profile.
web
https://www.techrunnr.com
email
praseeb@techrunnr.com
call
9446237102
follow me

In this article, we will see the commands used to convert.PFX certificate file to separate certificate and key file.

Check OpenSSL package is installed in your system.

Step1:

Go to the .pfx folder location.
Now type the below command to extract the private key from pfx file.


openssl pkcs12 -in [yourfile.pfx] -nocerts -out [keyfile-encrypted.key]

The explanation for this command, this command extract the private key from the .pfx file. Now we need to type the import password of the .pfx file. This password is used to protect the keypair which created for .pfx file. After entering import password OpenSSL requests to type another password twice. This new password is to protect the .key file.

techrunnr@ubuntu:~/Downloads/SSL-certificate$ openssl pkcs12 -in samplefile.pfx -nocerts -out samplefileencrypted.key
Enter Import Password:
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
techrunnr@ubuntu:~/Downloads/SSL-certificate$


DigiCertCA2.cer  samplefileencrypted.key  samplefile.pfx TrustedRoot.cer

Step2:

Extract the certificate:


openssl pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out [certificate.crt]

Just press enter and your certificate appears.

techrunnr@ubuntu:~/Downloads/SSL-certificate$ openssl pkcs12 -in samplefile.pfx -clcerts -nokeys -out samplefileencrypted.crt
Enter Import Password:
techrunnr@ubuntu:~/Downloads/SSL-certificate$ ls
DigiCertCA2.cer  samplefileencrypted.crt  samplefileencrypted.key  samplefile.pfx  TrustedRoot.cer

Step3:

Now we will see how to have an unencrypted .key file to import some applications/devices. Unencrypted keypair very unsafe, so be careful.

The command:

openssl rsa -in [keyfile-encrypted.key] -out [keyfile-decrypted.key]

We need to enter the import password which we created newly in step 1. Now we have a certificate(.crt) and the two private keys ( encrypted and unencrypted).

techrunnr@ubuntu:~/Downloads/SSL-certificate$ openssl rsa -in samplefileencrypted.key -out samplefileunencrypted.key
Enter pass phrase for samplefileencrypted.key:
writing RSA key
techrunnr@ubuntu:~/Downloads/SSL-certificate$ ls
DigiCertCA2.cer  samplefileencrypted.key  samplefile.pfx TrustedRoot.cer samplefileunencrypted.key

 

© 2019, Techrunnr. All rights reserved.

#1
#2
#3
Questions Answered
Articles Written
Overall Points

Related posts

Leave a Reply