219

How to generate a .pem CA certificate and client certificate from a PFX file using OpenSSL.

7 Answers 7

311

Another perspective for doing it on Linux... here is how to do it so that the resulting single file contains the decrypted private key so that something like HAProxy can use it without prompting you for passphrase.

openssl pkcs12 -in file.pfx -out file.pem -nodes

Then you can configure HAProxy to use the file.pem file.


This is an EDIT from previous version where I had these multiple steps until I realized the -nodes option just simply bypasses the private key encryption. But I'm leaving it here as it may just help with teaching.

openssl pkcs12 -in file.pfx -out file.nokey.pem -nokeys
openssl pkcs12 -in file.pfx -out file.withkey.pem
openssl rsa -in file.withkey.pem -out file.key
cat file.nokey.pem file.key > file.combo.pem
  1. The 1st step prompts you for the password to open the PFX.
  2. The 2nd step prompts you for that plus also to make up a passphrase for the key.
  3. The 3rd step prompts you to enter the passphrase you just made up to store decrypted.
  4. The 4th puts it all together into 1 file.

Then you can configure HAProxy to use the file.combo.pem file.

The reason why you need 2 separate steps where you indicate a file with the key and another without the key, is because if you have a file which has both the encrypted and decrypted key, something like HAProxy still prompts you to type in the passphrase when it uses it.

9
  • 1
    I havent spent the time to get intimately familiar with openssl, but the pem conversion was not including the private key. The edit provided the detail on how to merge the cert and key into one pem file, just what I needed.
    – ebt
    Commented Dec 8, 2014 at 16:33
  • 3
    On windows systems use type instead of cat
    – hupseb
    Commented Jan 31, 2015 at 9:17
  • 2
    On Windows this version of OpenSSL is easy to use for things like this: slproweb.com/products/Win32OpenSSL.html Commented May 5, 2016 at 16:49
  • 1
    The above steps worked well to convert a PFX to PEM. I had to do one additional step however: open the nokey PEM file in a text editor and move the last certificate in the chain to the top of the file. Otherwise nginx would throw an error complaining about the certs and refuse to use them. Commented Mar 17, 2017 at 20:55
  • In that case you could reorder the cat command to put it first. like: cat file.key file.nokey.pem > file.combo.pem Unless the file.key itself has multiple in wrong order. But either case, you could likely re-arrange stuff programmatically. Commented Sep 1, 2017 at 13:15
147

You can use the OpenSSL Command line tool. The following commands should do the trick

openssl pkcs12 -in client_ssl.pfx -out client_ssl.pem -clcerts

openssl pkcs12 -in client_ssl.pfx -out root.pem -cacerts

If you want your file to be password protected etc, then there are additional options.

You can read the entire documentation here.

2
  • 1
    This only worked on Windows when I used the OpenSSL .exe in "C:\Program Files\Git\usr\bin\openssl.exe". When I used openssl from the git bash I got errors of openssl pfx to pem error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong Commented May 10, 2021 at 3:24
  • External reference not working, here is the updated URL.. Commented Jan 25, 2023 at 6:27
116

Despite that the other answers are correct and thoroughly explained, I found some difficulties understanding them. Here is the method I used (Taken from here):

First case: To convert a PFX file to a PEM file that contains both the certificate and private key:

openssl pkcs12 -in filename.pfx -out cert.pem -nodes

Second case: To convert a PFX file to separate public and private key PEM files:

Extracts the private key form a PFX to a PEM file:

openssl pkcs12 -in filename.pfx -nocerts -out key.pem

Exports the certificate (includes the public key only):

openssl pkcs12 -in filename.pfx -clcerts -nokeys -out cert.pem

Removes the password (paraphrase) from the extracted private key (optional):

openssl rsa -in key.pem -out server.key
3
  • 4
    In the first case, I get prompted for a password, even though the original certs didn't have one. Commented Apr 17, 2021 at 14:50
  • 9
    @openCivilisation You can disable the setting of a PEM pass phrase for the key.pem by adding -nodes after the pkcs12
    – leonheess
    Commented Nov 10, 2021 at 20:09
  • 2
    In case any one wonders, -nodes means "no des", not the English word "note". See stackoverflow.com/questions/5051655 Commented Apr 12, 2023 at 0:05
10

You can extract ca-bundle, .crt and .key from .pfx using this.

# Extracting ca-certs..."
  openssl pkcs12 -in ${filename}.pfx -nodes -nokeys -cacerts -out ${filename}-ca.crt

# Extracting key file..."
  openssl pkcs12 -in ${filename}.pfx -nocerts -out ${filename}.key

# Extracting crt..."
  openssl pkcs12 -in ${filename}.pfx -clcerts -nokeys -out ${filename}.crt

# combine ca-certs and cert files
  cat  ${filename}.crt ${filename}-ca.crt > ${filename}-full.crt

# Removing passphrase from keyfile"
  openssl rsa -in ${filename}.key -out ${filename}.key

Link: https://gist.github.com/mediaupstream/a2694859b1afa59f26be5e8f6fd4806a

1
  • 1
    these are probably the instructions you want for nginx Commented Apr 12 at 16:28
6

For PFX that is locked with a password

It is recommended to combine the password argument, in one command, with the conversion, to avoid errors.

like this: This command is for extracting the private key

openssl pkcs12 -in "blablabla.pfx" -out key.key -nodes -passin pass:blablabla   

and this command for extracting the public key

openssl pkcs12 -in "blablabla.pfx" -clcerts -nokeys -out crt.crtpem -nodes -passin pass:blablabla
2
0

Yes as ben said if your cert has password you must provide on your openssl command --passin pass:xxxxx argument otherwise your pem file wont properly generated.

openssl pkcs12 -in file.pfx -out file.pem -nodes -passin pass:cert_pass
0

As of 2024, using openssl 3.3.1 on VMTux and no password on output (-legacy):

openssl pkcs12 -in input.pfx -passin pass:P@ssW0rd \
    -out crt.pem -clcerts -nokeys -legacy
openssl pkcs12 -in input.pfx -passin pass:P@ssW0rd \
    -out key.pem -nocerts -nodes -legacy

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.