How to Generate a PFX or P12 File Using OpenSSL

How to Generate a PFX File Using OpenSSL

1. Open a terminal or command prompt and run the following command:

openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile intermediate-chain.crt

The command uses the following options:

• -export — creates a PKCS#12 file.
• -out certificate.pfx — specifies the output filename.
• -inkey privateKey.key — specifies the private key file.
• -in certificate.crt — specifies the issued certificate file.
• -certfile intermediate-chain.crt — adds the intermediate certificate chain.

Replace the filenames with the actual paths to your files.

2. OpenSSL will prompt you to enter and confirm an export password. Choose a strong password and keep it safe. You will need it when importing the PFX file.

If your private key is itself password-protected, OpenSSL may also ask for its existing passphrase.

3. After the command completes, the PFX file will be saved at the location specified with the -out option.

How to Generate a P12 File Using OpenSSL

A P12 file uses the same PKCS#12 format as a PFX file. To create one, use the same command and change the output extension:

openssl pkcs12 -export -out certificate.p12 -inkey privateKey.key -in certificate.crt -certfile intermediate-chain.crt

Note: resulting .p12 file contains the same type of information as a .pfx file. The difference is only the filename extension.

How to Convert PEM Files to PFX or P12 Using OpenSSL

PEM is a text-based encoding commonly used for certificates and private keys. If your certificate and private key are already PEM-encoded, you can use the same OpenSSL command to create a PKCS#12 file.

For a PFX file:

openssl pkcs12 -export -out certificate.pfx -inkey privateKey.pem -in certificate.pem -certfile intermediate-chain.pem

For a P12 file:

openssl pkcs12 -export -out certificate.p12 -inkey privateKey.pem -in certificate.pem -certfile intermediate-chain.pem

How to Verify a PFX or P12 File

After creating the file, you can check its contents using OpenSSL:

openssl pkcs12 -info -in certificate.pfx -noout

Replace certificate.pfx with your actual filename. OpenSSL will prompt you for the export password and display information about the PKCS#12 structure without printing the certificates or private key.

Common Issues When Generating PFX/P12 Files

The following problems may occur when creating or importing a PFX/P12 file.

1. Incorrect Password

If you enter the wrong export password when importing the file, the import process may fail.

Solution: Check that you are using the password set during the OpenSSL export process.

2. Private Key Does Not Match the Certificate

The private key must correspond to the public key in the issued certificate. If they do not match, OpenSSL may fail to create the PFX/P12 file or the certificate may not work after installation.

You can compare their public key fingerprints using these commands:

openssl pkey -in privateKey.key -pubout -outform DER | openssl dgst -sha256
openssl x509 -in certificate.crt -pubkey -noout | openssl pkey -pubin -outform DER | openssl dgst -sha256

Compare the SHA-256 hashes returned by the commands. If they match, the private key corresponds to the certificate.

3. Missing Intermediate Certificates

If the intermediate certificate chain is not included, some applications may not be able to build a complete certificate chain.

Solution: Include the intermediate certificate file when creating the PFX/P12 file by using the -certfile option:

-certfile intermediate-chain.crt

4. Unsupported or Incorrect File Format

OpenSSL expects the input certificate and private key to be in a supported format. The filename extension alone does not determine the file format.

Solution: Check that your certificate and private key are in PEM format when using the commands above. If your files use another encoding, convert them to a supported format before exporting.

5. Incompatible Encryption Algorithms

Some older PFX/P12 files may use encryption algorithms that are not enabled by default in newer OpenSSL versions.

Solution: If you encounter an algorithm compatibility error while processing an older PKCS#12 file, check the OpenSSL version and the encryption algorithms used by that file. OpenSSL 3.x provides a -legacy option for working with certain older PKCS#12 formats.