OpenSSL pkcs12 Export chained CA Certs separately - ssl

Question

I have a cert chain that looks like this:
Global CA
Intermediate CA
MyCert
I am using openssl.exe to create .cer files from MyCert.pfx, and I want the generated cert to contain the client cert first, followed by the Intermediate CA cert. The end result should look something like this:
Bag Attributes
<mycert attributes>
-----BEGIN CERTIFICATE-----
<mycert data>
-----END CERTIFICATE-----
Bag Attributes
<intermediate ca attributes>
-----BEGIN CERTIFICATE-----
<intermediate ca data>
-----END CERTIFICATE-----
I can get the first cert by running
openssl pkcs12 -in MyCert.pfx -clcerts -nokeys -password pass:mypassword -out mycert.cer
And I can run the command to get the CA certs in the chain like this
openssl pkcs12 -in MyCert.pfx -cacerts -nokeys -password pass:mypassword -out cacert.cer
But this generates a file with both the Global CA and the Intermediate CA certs.
Is there a way to specify only the Intermediate CA by CN or something?
I can get the content out of the file but was hoping for a cleaner solution.

Answer 1

Well I opted for the gross way... Here it is.
# Generate the client cert
&"$opensslPath\openssl.exe" pkcs12 -in "$($filepathforCert).pfx" -clcerts -nokeys -out "$($filepathforCert)-fullchain.crt" -password pass:$certPassword
# Generate the CA certs in the chain
&"$opensslPath\openssl.exe" pkcs12 -in "$($filepathforCert).pfx" -cacerts -nokeys -out "$($filepathforCACert).crt" -password pass:$certPassword
# Combine certs
# The common name for the intermediate CA should be the same until 2031
$intermediateCaCn = "CN = DigiCert TLS RSA SHA256 2020 CA1"
$certBeginToken = "-----BEGIN CERTIFICATE-----"
$certEndToken = "-----END CERTIFICATE-----"
$intermediateCACertStart = (Select-String -Pattern $intermediateCaCn -Path "$($filepathforCACert).crt" -SimpleMatch | select-object -First 1).LineNumber
$firstCertStart = (Select-String -Pattern $certBeginToken -Path "$($filepathforCACert).crt" -SimpleMatch | select-object -First 1).LineNumber
$intermediateStartLine = 0
$intermediateEndLine = 0
# The beginning of the cert will always start after the CN
if($intermediateCACertStart -gt $firstCertStart)
{
$intermediateStartLine = (Select-String -Pattern $certBeginToken -Path "$($filepathforCACert).crt" -SimpleMatch | select-object -Last 1).LineNumber
$intermediateEndLine = (Select-String -Pattern $certEndToken -Path "$($filepathforCACert).crt" -SimpleMatch | select-object -Last 1).LineNumber
}
else
{
$intermediateStartLine = $firstCertStart
$intermediateEndLine = (Select-String -Pattern $certEndToken -Path "$($filepathforCACert).crt" -SimpleMatch | select-object -First 1).LineNumber
}
# size of the cert, including the delimiters
$lineCount = ($intermediateEndLine - $intermediateStartLine)
$certContent = (Get-Content -Path "$($filepathforCACert).crt"| Select-Object -Skip ($intermediateStartLine - 1) -First ($lineCount +1))
Add-Content -Path "$($filepathforCert)-fullchain.crt" -Value $certContent