How to Export Certs using OpenSSL

This how-to will walk you through extracting information from a PKCS#12 file with OpenSSL. PKCS#12 (also known as PKCS12 or PFX) is a binary format for storing a certificate chain and private key in a single, encryptable file. PKCS#12 files are commonly used to import and export certificates and private keys on Windows and macOS computers, and usually have the filename extensions .p12 or .pfx.

In all of the examples shown below, substitute the names of the files you are actually working with for 

View PKCS#12 Information on Screen

To dump all of the information in a PKCS#12 file to the screen in PEM format, use this command: openssl pkcs12 -info -in INFILE.p12 -nodes

You will then be prompted for the PKCS#12 file’s password:

Type the password entered when creating the PKCS#12 file and press 

Encrypt Private Key

If you would like to encrypt the private key and protect it with a password before output, simply omit the -nodes flag from the command:

openssl pkcs12 -info -in INFILE.p12

In this case, you will be prompted to enter and verify a new password after OpenSSL outputs any certificates, and the private key will be encrypted (note that the text of the key begins with 

):

Enter PEM pass phrase:

Extract Only Certificates or Private Key

If you only want to output the private key, add -nocerts to the command:

openssl pkcs12 -info -in aaron__russell.p12 -nodes -nocerts

If you only need the certificates, use -nokeys

 (and since we aren’t concerned with the private key we can also safely omit -nodes):

Save Certificates and Private Keys to Files

You can export the certificates and private key from a PKCS#12 file and save them in PEM format to a new file by specifying an output filename:

Again, you will be prompted for the PKCS#12 file’s password. As before, you can encrypt the private key by removing the -nodes flag from the command and/or add -nocerts or -nokeys to output only the private key or certificates. So, to generate a private key file, we can use this command:

openssl pkcs12 -in INFILE.p12 -out OUTFILE.key -nodes -nocerts

And to create a file including only the certificates, use this:

Convert Private Key to PKCS#1 Format

The examples above all output the private key in OpenSSL’s default PKCS#8 format. If you know you need PKCS#1 instead, you can pipe the output of the OpenSSL’s PKCS#12 utility to its RSA or EC utility depending on the key type. Both of the commands below will output a key file in PKCS#1 format:

RSA

EC