3

I have a certificate that is a PKCS#7 certificate (.spc), and also have a .pem file, how can I convert this to .pfx file on OpenSSL app?

Thanks.

1

1 Answer 1

2

First, file extensions have no power; they are usually used to indicate the format of the file contents but nothing enforces this. Thus a file named 'something.pem' usually should contain PEM-format data, but it is entirely possible to use that extension for a file that isn't PEM, and to use a different extension for a file that is PEM.

Second, PEM is not a single format, it is a family of dozens of formats, including about one dozen used for private keys.

If you have a .pem file which is actually a private key in one of the PEM formats supported by OpenSSL, and the PKCS7 (.spc) file contains the cert or chain for the public key which matches that private key, and you have or get OpenSSL (since you tagged it I assume you do), then:

 openssl pkcs7 -in whatever.spc -inform der -print_certs \
 | openssl pkcs12 -export -inkey keyfile.pem -out newfile.pfx 

If you have a .pem file which is anything other than a PEM-format private key matching the public key in the cert/chain in the PKCS7, you do not have the the data necessary to create a PKCS12/PFX file.

4
  • Thanks for the respond, do i need to open OpenSSL using CMD as Administrator?, and do i need to place my spc and pem file in the directoryof openssl?
    – user7676403
    Feb 9, 2018 at 1:24
  • @NicoTing: OpenSSL doesn't need admin on Windows, or root on Unix, or any special privilege besides accessing the files you specify. It can access files anywhere you specify a path and have permission, although if you make your working dir the OpenSSL install dir (you don't need to if you specify the program path or set your PATH envvar) you may find it convenient to put your files there. However, if you install under \Program Files* or \Windows (which is usually not the default) don't put data files there for any program on modern Windows. Feb 10, 2018 at 2:44
  • I run CMD as admin and type this: cd \ | mkdir certificate | cd certificate | set RANDFILE=c:\certificate\.rnd | set OPENSSL_CONF=c:\OpenSSL-Win32\bin\opennssl.cfg | C:\OpenSSL-Win32\bin\openssl.exe I put my pem and spc file in the certificate folder, but your code doesnt work
    – user7676403
    Feb 12, 2018 at 1:27
  • @NicoTing: I forgot the CMD part. Using backslash to continue a command works on shells but not on CMD. Either type it without the backslash on one logical line (using wraparound) or use 'hat' ^ instead of backslash. Feb 12, 2018 at 3:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.