How to convert PFX to separate .key/.crt file

Published by Praseeb K Das on

In this article, we will see the commands used to convert.PFX certificate file to separate certificate and key file.

Check OpenSSL package is installed in your system.

Step1:

Go to the .pfx folder location.
Now type the below command to extract the private key from pfx file.


openssl pkcs12 -in [yourfile.pfx] -nocerts -out [keyfile-encrypted.key]

The explanation for this command, this command extract the private key from the .pfx file. Now we need to type the import password of the .pfx file. This password is used to protect the keypair which created for .pfx file. After entering import password OpenSSL requests to type another password twice. This new password is to protect the .key file.

techrunnr@ubuntu:~/Downloads/SSL-certificate$ openssl pkcs12 -in samplefile.pfx -nocerts -out samplefileencrypted.key
Enter Import Password:
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
techrunnr@ubuntu:~/Downloads/SSL-certificate$


DigiCertCA2.cer  samplefileencrypted.key  samplefile.pfx TrustedRoot.cer

Step2:

Extract the certificate:


openssl pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out [certificate.crt]

Just press enter and your certificate appears.

techrunnr@ubuntu:~/Downloads/SSL-certificate$ openssl pkcs12 -in samplefile.pfx -clcerts -nokeys -out samplefileencrypted.crt
Enter Import Password:
techrunnr@ubuntu:~/Downloads/SSL-certificate$ ls
DigiCertCA2.cer  samplefileencrypted.crt  samplefileencrypted.key  samplefile.pfx  TrustedRoot.cer

Step3:

Now we will see how to have an unencrypted .key file to import some applications/devices. Unencrypted keypair very unsafe, so be careful.

The command:

openssl rsa -in [keyfile-encrypted.key] -out [keyfile-decrypted.key]

We need to enter the import password which we created newly in step 1. Now we have a certificate(.crt) and the two private keys ( encrypted and unencrypted).

techrunnr@ubuntu:~/Downloads/SSL-certificate$ openssl rsa -in samplefileencrypted.key -out samplefileunencrypted.key
Enter pass phrase for samplefileencrypted.key:
writing RSA key
techrunnr@ubuntu:~/Downloads/SSL-certificate$ ls
DigiCertCA2.cer  samplefileencrypted.key  samplefile.pfx TrustedRoot.cer samplefileunencrypted.key

 

© 2019, Techrunnr. All rights reserved.

#1
#2
#3
Questions Answered
Articles Written
Overall Points
Categories: LinuxopensourceSecurity
Tags:

0 Comments

Leave a Reply

Related Posts

database

Change the MariaDB Default Data Directory

Share this on WhatsApp We need to change the default data directory /var/lib/mysql to a different location. Now we will see how to change the default MySQL / MariaDB data directory to a different path Read more…

database

Change MongoDB Default Data Path in Linux

Share this on WhatsApp We will see how to change the default MongoDB database server directory, by default, it is stored all data in /var/lib/mongo. Now we will see how to change this directory. Before Read more…

change the default Docker Root Directory and set SELinux file contexts
devops

Change the default Docker Root Dir and set SELinux file contexts

Share this on WhatsApp Docker uses (/var/lib/docker) as default root directory to provide storage. We will see how to change this root directory to some other directory, let’s say ‘/home/techrunnr/docker’. Lets login to our docker Read more…