How to convert PFX to separate .key/.crt file

Published by Praseeb K Das on

In this article, we will see the commands used to convert.PFX certificate file to separate certificate and key file.

Check OpenSSL package is installed in your system.

Step1:

Go to the .pfx folder location.
Now type the below command to extract the private key from pfx file.


openssl pkcs12 -in [yourfile.pfx] -nocerts -out [keyfile-encrypted.key]

The explanation for this command, this command extract the private key from the .pfx file. Now we need to type the import password of the .pfx file. This password is used to protect the keypair which created for .pfx file. After entering import password OpenSSL requests to type another password twice. This new password is to protect the .key file.

techrunnr@ubuntu:~/Downloads/SSL-certificate$ openssl pkcs12 -in samplefile.pfx -nocerts -out samplefileencrypted.key
Enter Import Password:
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
techrunnr@ubuntu:~/Downloads/SSL-certificate$


DigiCertCA2.cer  samplefileencrypted.key  samplefile.pfx TrustedRoot.cer

Step2:

Extract the certificate:


openssl pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out [certificate.crt]

Just press enter and your certificate appears.

techrunnr@ubuntu:~/Downloads/SSL-certificate$ openssl pkcs12 -in samplefile.pfx -clcerts -nokeys -out samplefileencrypted.crt
Enter Import Password:
techrunnr@ubuntu:~/Downloads/SSL-certificate$ ls
DigiCertCA2.cer  samplefileencrypted.crt  samplefileencrypted.key  samplefile.pfx  TrustedRoot.cer

Step3:

Now we will see how to have an unencrypted .key file to import some applications/devices. Unencrypted keypair very unsafe, so be careful.

The command:

openssl rsa -in [keyfile-encrypted.key] -out [keyfile-decrypted.key]

We need to enter the import password which we created newly in step 1. Now we have a certificate(.crt) and the two private keys ( encrypted and unencrypted).

techrunnr@ubuntu:~/Downloads/SSL-certificate$ openssl rsa -in samplefileencrypted.key -out samplefileunencrypted.key
Enter pass phrase for samplefileencrypted.key:
writing RSA key
techrunnr@ubuntu:~/Downloads/SSL-certificate$ ls
DigiCertCA2.cer  samplefileencrypted.key  samplefile.pfx TrustedRoot.cer samplefileunencrypted.key

 

© 2019, Techrunnr. All rights reserved.

#1
#2
#3
Questions Answered
Articles Written
Overall Points
Categories: LinuxopensourceSecurity
Tags:

0 Comments

Leave a Reply

Related Posts

database

Clear Mysql ibdata1

Share this on WhatsApp Hi Techrunnr, this document deals with How to shrink ibdata1 file in /var/lib/mysql/. By default ibdata1 file in /var/lib/mysql/ normally consists of 4 types of data Table Data Table Indexes MVCC Read more…

application

how to change the keycloak database to MySQL from h2

Share this on WhatsApp In this document, we will check how to change the keycloak database to MySQL from h2. Keycloak comes with its own embedded Java-based relational database called H2. This is the default Read more…

application

how to set up a keycloak server in Linux

Share this on WhatsApp Hi All, this document shows you how to set up a keycloak server in Linux. Keycloak is an open-source software product to allow single sign-on with Identity Management and Access Management Read more…

Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.
I agree to Terms of Service and Privacy Policy
SIGN UP FOR NEWSLETTER NOW