164

How to generate a .pem CA certificate and client certificate from a PFX file using OpenSSL.

nyedidikeke
  • 5,992
  • 7
  • 40
  • 52
new bie
  • 2,415
  • 5
  • 22
  • 26

3 Answers3

239

Another perspective for doing it on Linux... here is how to do it so that the resulting single file contains the decrypted private key so that something like HAProxy can use it without prompting you for passphrase.

openssl pkcs12 -in file.pfx -out file.pem -nodes

Then you can configure HAProxy to use the file.pem file.

This is an EDIT from previous version where I had these multiple steps until I realized the -nodes option just simply bypasses the private key encryption. But I'm leaving it here as it may just help with teaching.

openssl pkcs12 -in file.pfx -out file.nokey.pem -nokeys
openssl pkcs12 -in file.pfx -out file.withkey.pem
openssl rsa -in file.withkey.pem -out file.key
cat file.nokey.pem file.key > file.combo.pem
  1. The 1st step prompts you for the password to open the PFX.
  2. The 2nd step prompts you for that plus also to make up a passphrase for the key.
  3. The 3rd step prompts you to enter the passphrase you just made up to store decrypted.
  4. The 4th puts it all together into 1 file.

Then you can configure HAProxy to use the file.combo.pem file.

The reason why you need 2 separate steps where you indicate a file with the key and another without the key, is because if you have a file which has both the encrypted and decrypted key, something like HAProxy still prompts you to type in the passphrase when it uses it.

user2415376
  • 2,934
  • 2
  • 15
  • 13
  • 1
    I havent spent the time to get intimately familiar with openssl, but the pem conversion was not including the private key. The edit provided the detail on how to merge the cert and key into one pem file, just what I needed. – ebt Dec 08 '14 at 16:33
  • 3
    On windows systems use type instead of cat – hupseb Jan 31 '15 at 09:17
  • 2
    On Windows this version of OpenSSL is easy to use for things like this: http://slproweb.com/products/Win32OpenSSL.html – Helge Klein May 05 '16 at 16:49
  • The above steps worked well to convert a PFX to PEM. I had to do one additional step however: open the nokey PEM file in a text editor and move the last certificate in the chain to the top of the file. Otherwise nginx would throw an error complaining about the certs and refuse to use them. – EugeneRomero Mar 17 '17 at 20:55
  • In that case you could reorder the cat command to put it first. like: cat file.key file.nokey.pem > file.combo.pem Unless the file.key itself has multiple in wrong order. But either case, you could likely re-arrange stuff programmatically. – user2415376 Sep 01 '17 at 13:15
  • use this arguments for passwords: '-password p set import/export password source -passin p input file pass phrase source -passout p output file pass phrase source' – Ivan Temchenko Sep 30 '18 at 13:24
  • Worth mentioning that `openssl` can hang for some people on windows, I found from this [answer](https://stackoverflow.com/a/38202633/198348) that using `winpty` helps fix the terminal I/O. – Ehtesh Choudhury Dec 12 '18 at 10:07
  • I had to append clcerts too: `openssl pkcs12 -in file.pfx -out file.pem -nodes -clcerts` then I get a single file I could use with `cert` – dashesy Sep 10 '20 at 20:24
135

You can use the OpenSSL Command line tool. The following commands should do the trick

openssl pkcs12 -in client_ssl.pfx -out client_ssl.pem -clcerts

openssl pkcs12 -in client_ssl.pfx -out root.pem -cacerts

If you want your file to be password protected etc, then there are additional options.

You can read the entire documentation here.

Tom Padilla
  • 843
  • 8
  • 29
Jay
  • 23,225
  • 23
  • 88
  • 135
  • 1
    This only worked on Windows when I used the OpenSSL .exe in "C:\Program Files\Git\usr\bin\openssl.exe". When I used `openssl` from the git bash I got errors of `openssl pfx to pem error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong` – Chris Halcrow May 10 '21 at 03:24
56

Despite that the other answers are correct and thoroughly explained, I found some difficulties understanding them. Here is the method I used (Taken from here):

First case: To convert a PFX file to a PEM file that contains both the certificate and private key:

openssl pkcs12 -in filename.pfx -out cert.pem -nodes

Second case: To convert a PFX file to separate public and private key PEM files:

Extracts the private key form a PFX to a PEM file:

openssl pkcs12 -in filename.pfx -nocerts -out key.pem

Exports the certificate (includes the public key only):

openssl pkcs12 -in filename.pfx -clcerts -nokeys -out cert.pem

Removes the password (paraphrase) from the extracted private key (optional):

openssl rsa -in key.pem -out server.key
Mohammed Noureldin
  • 12,127
  • 14
  • 68
  • 86