Sometimes you're given all the certificate files you need. Other times you're given a PFX file... If you don't know by now, the PFX file is used primarily on Windows based IIS servers. But sometimes, if you run an Apache server, or load balancer, you need multiple files (cert, key, cert chain) in order to update the certificate information. This issue can arise if you're using a shared cert (like a wildcard), or if the person that manages the certs in your IT shop pulls a PFX without thinking. The easiest option is usually just to request the separate files from your Cert Issuing company, but sometimes that takes too long (if you aren't the one that manages it), or could potentially cost extra money.
The process I outline below was completed on a Linux server with OpenSSL. Now, this can be completed on a Windows system, as long as OpenSSL is installed. I'll detail some Windows specific stuff, but this post will not be going over how to install OpenSSL. If you're doing this on a Linux box (you probably don't need to hear this but...) you will just need to copy the PFX file to the directory of your choice.
Windows Specifics
If you are using a Windows system and do not register OpenSSL as an environment variable, then I suggest copying your PFX file to the OpenSSL instillation directory \bin folder. This will make running the below commands a little easier. You will need to open a command prompt and CD (change directory) to the OpenSSL bin folder. From there, you should be able to run through the below commands.
Extraction Process
Now, these commands could be figured out by simply reading through the OpenSSL documentation, or man page (always RTFM), but who wants to do that when folks like me are willing to just highlight common tasks. So here they are:
Extracting the private key
Now, if i need to tell you that extracting the private key unencrypted could be dangerous, than you shouldn't be doing this in the first place. But there it is. Also, if you don't know the password to the PFX file, then you either shouldn't be doing this, or you should just pitch the PFX and request a new one.
There it is, nice and simple.
The process I outline below was completed on a Linux server with OpenSSL. Now, this can be completed on a Windows system, as long as OpenSSL is installed. I'll detail some Windows specific stuff, but this post will not be going over how to install OpenSSL. If you're doing this on a Linux box (you probably don't need to hear this but...) you will just need to copy the PFX file to the directory of your choice.
Windows Specifics
If you are using a Windows system and do not register OpenSSL as an environment variable, then I suggest copying your PFX file to the OpenSSL instillation directory \bin folder. This will make running the below commands a little easier. You will need to open a command prompt and CD (change directory) to the OpenSSL bin folder. From there, you should be able to run through the below commands.
Extraction Process
Now, these commands could be figured out by simply reading through the OpenSSL documentation, or man page (always RTFM), but who wants to do that when folks like me are willing to just highlight common tasks. So here they are:
Extracting the private key
openssl pkcs12 -in [certificate.pfx] -nocerts -out [keyfile-encrypted.key]Extracting the private key inot PEM format
openssl rsa -in [keyfile-encrypted.key] -outform PEM -out [keyfile-encrypted-pem.key]Extracting an unencrypted private key
openssl rsa -in [keyfile-encrypted.key] -out [keyfile-decrypted.key]Extracting the certificate
openssl pkcs12 -in [certificate.pfx] -clcerts -nokeys -out [certificate.crt]Extracting the certificate chain
openssl pkcs12 -in [certificate.pfx] -cacerts -nokeys -out [cert-chain.crt]
Now, if i need to tell you that extracting the private key unencrypted could be dangerous, than you shouldn't be doing this in the first place. But there it is. Also, if you don't know the password to the PFX file, then you either shouldn't be doing this, or you should just pitch the PFX and request a new one.
There it is, nice and simple.
Comments
Post a Comment