How to generate a .pem
CA certificate and client certificate from a PFX file using OpenSSL.
7 Answers
Another perspective for doing it on Linux... here is how to do it so that the resulting single file contains the decrypted private key so that something like HAProxy can use it without prompting you for passphrase.
openssl pkcs12 -in file.pfx -out file.pem -nodes
Then you can configure HAProxy to use the file.pem file.
This is an EDIT from previous version where I had these multiple steps until I realized the -nodes option just simply bypasses the private key encryption. But I'm leaving it here as it may just help with teaching.
openssl pkcs12 -in file.pfx -out file.nokey.pem -nokeys
openssl pkcs12 -in file.pfx -out file.withkey.pem
openssl rsa -in file.withkey.pem -out file.key
cat file.nokey.pem file.key > file.combo.pem
- The 1st step prompts you for the password to open the PFX.
- The 2nd step prompts you for that plus also to make up a passphrase for the key.
- The 3rd step prompts you to enter the passphrase you just made up to store decrypted.
- The 4th puts it all together into 1 file.
Then you can configure HAProxy to use the file.combo.pem file.
The reason why you need 2 separate steps where you indicate a file with the key and another without the key, is because if you have a file which has both the encrypted and decrypted key, something like HAProxy still prompts you to type in the passphrase when it uses it.
-
1I havent spent the time to get intimately familiar with openssl, but the pem conversion was not including the private key. The edit provided the detail on how to merge the cert and key into one pem file, just what I needed.– ebtCommented Dec 8, 2014 at 16:33
-
3
-
2On Windows this version of OpenSSL is easy to use for things like this: slproweb.com/products/Win32OpenSSL.html Commented May 5, 2016 at 16:49
-
1The above steps worked well to convert a PFX to PEM. I had to do one additional step however: open the nokey PEM file in a text editor and move the last certificate in the chain to the top of the file. Otherwise nginx would throw an error complaining about the certs and refuse to use them. Commented Mar 17, 2017 at 20:55
-
In that case you could reorder the cat command to put it first. like: cat file.key file.nokey.pem > file.combo.pem Unless the file.key itself has multiple in wrong order. But either case, you could likely re-arrange stuff programmatically. Commented Sep 1, 2017 at 13:15
You can use the OpenSSL Command line tool. The following commands should do the trick
openssl pkcs12 -in client_ssl.pfx -out client_ssl.pem -clcerts
openssl pkcs12 -in client_ssl.pfx -out root.pem -cacerts
If you want your file to be password protected etc, then there are additional options.
You can read the entire documentation here.
-
1This only worked on Windows when I used the OpenSSL .exe in "C:\Program Files\Git\usr\bin\openssl.exe". When I used
openssl
from the git bash I got errors ofopenssl pfx to pem error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong
Commented May 10, 2021 at 3:24 -
External reference not working, here is the updated URL.. Commented Jan 25, 2023 at 6:27
Despite that the other answers are correct and thoroughly explained, I found some difficulties understanding them. Here is the method I used (Taken from here):
First case: To convert a PFX file to a PEM file that contains both the certificate and private key:
openssl pkcs12 -in filename.pfx -out cert.pem -nodes
Second case: To convert a PFX file to separate public and private key PEM files:
Extracts the private key form a PFX to a PEM file:
openssl pkcs12 -in filename.pfx -nocerts -out key.pem
Exports the certificate (includes the public key only):
openssl pkcs12 -in filename.pfx -clcerts -nokeys -out cert.pem
Removes the password (paraphrase) from the extracted private key (optional):
openssl rsa -in key.pem -out server.key
-
4In the first case, I get prompted for a password, even though the original certs didn't have one. Commented Apr 17, 2021 at 14:50
-
9@openCivilisation You can disable the setting of a PEM pass phrase for the key.pem by adding
-nodes
after thepkcs12
Commented Nov 10, 2021 at 20:09 -
2In case any one wonders, -nodes means "no des", not the English word "note". See stackoverflow.com/questions/5051655 Commented Apr 12, 2023 at 0:05
You can extract ca-bundle, .crt and .key from .pfx using this.
# Extracting ca-certs..."
openssl pkcs12 -in ${filename}.pfx -nodes -nokeys -cacerts -out ${filename}-ca.crt
# Extracting key file..."
openssl pkcs12 -in ${filename}.pfx -nocerts -out ${filename}.key
# Extracting crt..."
openssl pkcs12 -in ${filename}.pfx -clcerts -nokeys -out ${filename}.crt
# combine ca-certs and cert files
cat ${filename}.crt ${filename}-ca.crt > ${filename}-full.crt
# Removing passphrase from keyfile"
openssl rsa -in ${filename}.key -out ${filename}.key
Link: https://gist.github.com/mediaupstream/a2694859b1afa59f26be5e8f6fd4806a
-
1
For PFX that is locked with a password
It is recommended to combine the password argument, in one command, with the conversion, to avoid errors.
like this: This command is for extracting the private key
openssl pkcs12 -in "blablabla.pfx" -out key.key -nodes -passin pass:blablabla
and this command for extracting the public key
openssl pkcs12 -in "blablabla.pfx" -clcerts -nokeys -out crt.crtpem -nodes -passin pass:blablabla
-
1the downside of doing it this way is now the password for your pfx file is in your command history... Commented Dec 20, 2023 at 1:56
-
You can run
unset HISTFILE
and the history won't be saved from the current session. Still, this is a much better solution: gist.github.com/whereisaaron/21e9caf02f97143bb338ec4f6f7f5aec– mbomb007Commented Jan 3 at 16:42
Yes as ben said if your cert has password you must provide on your openssl command --passin pass:xxxxx argument otherwise your pem file wont properly generated.
openssl pkcs12 -in file.pfx -out file.pem -nodes -passin pass:cert_pass
As of 2024, using openssl 3.3.1 on VMTux and no password on output (-legacy):
openssl pkcs12 -in input.pfx -passin pass:P@ssW0rd \
-out crt.pem -clcerts -nokeys -legacy
openssl pkcs12 -in input.pfx -passin pass:P@ssW0rd \
-out key.pem -nocerts -nodes -legacy