3

I am trying to create a self sign certificate and then convert that certificate to P7 format with full certificate chain. I am able to create a self sign certificate, but not sure how to convert this to p7 with full certificate chain

Following are the steps which i have taken to create a self signed certificate

openssl genrsa -des3 -out server.key 4096
openssl req -new -key server.key -out server.csr
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
openssl pkcs12 -export -in fiserv\server.crt -inkey fiserv\server.key -out fiserv\server.p12

What am i doing wrong here?

1 Answer 1

5

You say you want to have P7 format (I assume you mean PKCS#7 / P7B), but you are using the pkcs12 command (for PKCS#12 / PFX format). Try the crl2pkcs7 command instead:

openssl crl2pkcs7 -nocrl -certfile fiserv\server.crt -out fiserv\server.p7b -certfile path\to\CA\CACert.cer

I recommend reading https://www.sslshopper.com/ssl-converter.html, as it explains the different formats and conversions between them. Using that web page I have come up with this quick "cheat sheet" for the conversions that I frequently use:

  • DER to PEM: openssl x509 -inform DER -in cert.der -out cert.pem
  • PEM to DER: openssl x509 -outform DER -in cert.pem -out cert.der
  • PEM to PKCS#12 / PFX: openssl pkcs12 -export -in cert.pem -out cert.p12
  • PEM to PKCS#7 / P7B: openssl crl2pkcs7 -nocrl -certfile cert.pem -out cert.p7b
  • PKCS#12 to PEM: openssl pkcs12 -in cert.p12 -out cert.pem
  • PKCS#7 / P7B to PEM: openssl pkcs7 -in cert.p7b -print_certs -out cert.pem

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.