Skip to main content

Extracting Key, Cert, and Cert Chain from a PFX file

Sometimes you're given all the certificate files you need. Other times you're given a PFX file... If you don't know by now, the PFX file is used primarily on Windows based IIS servers. But sometimes, if you run an Apache server, or load balancer, you need multiple files (cert, key, cert chain) in order to update the certificate information. This issue can arise if you're using a shared cert (like a wildcard), or if the person that manages the certs in your IT shop pulls a PFX without thinking. The easiest option is usually just to request the separate files from your Cert Issuing company, but sometimes that takes too long (if you aren't the one that manages it), or could potentially cost extra money.

The process I outline below was completed on a Linux server with OpenSSL. Now, this can be completed on a Windows system, as long as OpenSSL is installed. I'll detail some Windows specific stuff, but this post will not be going over how to install OpenSSL. If you're doing this on a Linux box (you probably don't need to hear this but...) you will just need to copy the PFX file to the directory of your choice.

Windows Specifics

 If you are using a Windows system and do not register OpenSSL as an environment variable, then I suggest copying your PFX file to the OpenSSL instillation directory \bin folder. This will make running the below commands a little easier. You will need to open a command prompt and CD (change directory) to the OpenSSL bin folder. From there, you should be able to run through the below commands.

Extraction Process

 Now, these commands could be figured out by simply reading through the OpenSSL documentation, or man page (always RTFM), but who wants to do that when folks like me are willing to just highlight common tasks. So here they are:

Extracting the private key
openssl pkcs12 -in [certificate.pfx] -nocerts -out [keyfile-encrypted.key]
Extracting the private key inot PEM format
openssl rsa -in [keyfile-encrypted.key] -outform PEM -out [keyfile-encrypted-pem.key]
Extracting an unencrypted private key
openssl rsa -in [keyfile-encrypted.key] -out [keyfile-decrypted.key]
Extracting the certificate
openssl pkcs12 -in [certificate.pfx] -clcerts -nokeys -out [certificate.crt]
Extracting the certificate chain
openssl pkcs12 -in [certificate.pfx] -cacerts -nokeys -out [cert-chain.crt]

Now, if i need to tell you that extracting the private key unencrypted could be dangerous, than you shouldn't be doing this in the first place. But there it is. Also, if you don't know the password to the PFX file, then you either shouldn't be doing this, or you should just pitch the PFX and request a new one.

There it is, nice and simple.
Labels:

Comments

Post a Comment

Popular posts from this blog

PowerShell Scripting: Low Disk Space Notification

Update 20150812 You'll see in the below comments that I left a global variable that was not required in the original script. The below post has been updated with that variable removed. Original Post So, I came across a need to have a script that checks the free space of a hard drive, calculates the percentage and send an e-mail notification of the free space is less than 10%. I figured that this could be scripted with PowerShell and run as a scheduled task in Windows. One thing I did find out is that I needed to create a service account in Active Directory with Server Admin permissions. Once you have that account in place simply copy the script below and name it "WhatYouWant.ps1" and set your Windows task accordingly. Disclaimer: I did reach out for assistance with creating this script on StackOverflow. My original script was writing the output to a text file, and copying the contents of that text file into the e-mail notification. This was not acceptable for the long...
5 comments
Read more

Using Python for GPG/PGP File Encryption - Part 1

So, this will be the start of a series that will build a python script for GPG/PGP file encryption. In this post, we'll look at installing gnupg for python and using python to setup the keystore, create a private key, exporting the associated public key, and importing a public key. Now everything done here can be done with simple gnupg commands, but learning how to do this with python will help in understanding the script we'll be building to complete file encryption. I will be covering non-python gnupg commands in a future post. Additionally, the folks at the python-gnupg site over at pythonhosted.org have done a really great job at documenting everything (link to their site at the bottom). The stuff I'll be going over will be more of a start-to-finish for anyone that may get lost in the muck of doing stuff with python. Full Disclosure #1: Any key identifier throughout the series of posts is FICTITIOUS and DOES NOT represent any real key, either associated with myself or...
1 comment
Read more

Getting Samsung Dex Configured to Work with Azure DevOps Repos

Recently, I upgraded my phone to the Samsung Galaxy Note 10+... I'm a big fan of big phones (a perk to being a big guy). I've always been intrigued with the idea of using one device for everything. Well, with the Samsung Dex application that comes built into these next gen phones, it might be possible...?  As a guy that spends a lot of time working on ARM Templates and PowerShell scripts for Azure management, I was curious to see if I could get my phone, using Dex, connected to my Azure DevOps environment and start working with repos.... Well, to my surprise, I was able to, and without much pain. So, in this post, I'll run through how I got my Dex environment setup and working with Azure DevOps Repos. Getting Started With Samsung Dex open, go to the Google Play store and install Termux ( https://play.google.com/store/apps/details?id=com.termux&hl=en_US ) Once that's installed, open it! Next, we need to gift Termux with permissions to a...
Post a Comment
Read more