I need to upload a qualified certificate in .pfx file, I have .req and .pfx with private key files from requesting the certificate, and I got the qualified .crt certificate from the company that do these. How can I join the password and the certificate with qualified roots?
I already tried openssl Openssl pkcs12 -export -inkey KEYFILENAME -in CERTFILEFILENAME -out final.pfx
output was: error in pkcs12, expecting: any private key
Thank you, this is very important for me.
You say you have '.pfx with private key' but do not say anything about a PEM-format private key. The input for pkcs12 -export -inkey must be a PEM-format private key.
Extract the privatekey from the existing/original pfx with openssl pkcs12 -in oldpfx -nocerts without -export and either store it in a file and feed that to -inkey, or just concatenate with your cert and pipe the combination to openssl pkcs12 -export without -in -inkey.
Note this 'joins' the privatekey and the certificate, but there is no permanent linkage to any password(s); each privatekey file (PEM format or pfx/p12) can be encrypted with any password you choose (except openssl will usually reject very short passwords) and they don't need to be the same, and each can be changed without changing the privatekey (and cert) -- although you may well choose to make them and keep them the same for your own convenience.
Also note that certificates issued by public CAs like Verisign and GoDaddy etc usually depend on intermediate aka chain certificates, and in many perhaps most cases software that uses a pfx/pf12 needs it to contain those intermediate/chain certs. However, you didn't give any clues about this in your Q and there are so many possible variations of how to select, get, convert and use chain certs I couldn't fit them all in one SO answer.
Related
I need to create a custom certificate for my dynamics portal to use implicit grant flow. I create certificate with command
certbot certonly --manual --preferred-challenge dns
I then create pfx with the openssl command
openssl pkcs12 -export -out bundle.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem -password pass:SOMEPASSWORDHERE
However I get the error when trying to upload it to the power platform admin centre
The password entered is incorrect or the encryption method used by the
certificate is not supported.
So then tried the following command to create the pfx with triple des using
openssl pkcs12 -export -descert -out bundle.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem -password pass:SOMEPASSWORDHERE
But am still getting the same error. As far as I can see the certificate meets requirements of:
Signed by a trusted certificate authority.
Exported as a password-protected PFX file.
Contains private key at least 2048 bits long.
Contains all intermediate certificates in the certificate chain.
Must be SHA2 enabled; SHA1 support is being removed from popular browsers.
PFX file must be encrypted with TripleDES encryption. Power Apps portals doesn't support AES-256 encryption
The only thing I can think is the pfx isn't getting encrypted with 3des but looking at the openssl documentation the -descert command should take care of that. Am I missing something here?
I have a bunch of .Pem files.
One is (as far as I can tell) the CACert
mycacert.pem
the other is the certificate
mycert.pem
and finally what I am led to believe is the key file which is confusingly called the same as the certificate (but for this example I will call it something different)
key.pem
How do I form a PFX file from these?
I have tried to run the following command
openssl pkey -in C:\Temp\key.pem -out C:\Temp\my.key
however I get the following error
unable to load key 2147581984:error:0909006C:PEM routines:get_name:no
start line:crypto/pem/pem_lib.c:745:Expecting: ANY PRIVATE KEY
If I open the file in notepad I see the following
-----BEGIN NEW CERTIFICATE REQUEST-----
many characters
-----END NEW CERTIFICATE REQUEST-----
Basically I just need to create a pfx from the files I have but I seem to need a *.key file, a *.crt file and another *.crt file for the CACert, non of which I have.
One more thing to note. The two certificate pem files contain multiple certificates in each.
The command you are looking for is:
openssl pkcs12 -export -in cert.pem -inkey key.pem -out pkcs12.pfx -certfile cacert.pem
Where cert.pem is your certificate, key.pem is the private key, cacert.pem is the CA certificate and pkcs12.pfx is the pkcs12 file that will be created.
The command may asks for a password to decrypt the private key and will ask for a new password to encrypt the private key inside the pkcs12.
You can find the openssl pkcs12 command documentation, here.
I'm having problems understanding the difference between files produced by openssl and how to detect them.
For example I'm trying to generate Self-signed cert with private key and generate JKS file from p12
format. I'm googling like a madman but I still don't know how to generate it correctly to be able to use following commands.
openssl pkcs12 -export -in user.pem -inkey user.key -certfile user.pem -out testkeystore.p12
keytool -importkeystore -srckeystore testkeystore.p12 -srcstoretype pkcs12 -destkeystore wso2carbon.jks -deststoretype JKS
Source: https://www.ibm.com/support/pages/how-generate-jks-keystore-existing-private-key
I found a couple of different commands to generate Self-signed cert and private key but I don't know how to map resulting files to the commands above and whats worse I don't understand what those commands do.
I mean I see what files they generate and understand that certificate and private key used to sign it ( or maybe the other way around :| ) but what is the difference between those commands and is cert.pem === certificate.crt - Those file extensions are driving me crazy.
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout privateKey.key -out certificate.crt
openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout key.pem -out cert.pem
This is yet another situation where I'm having similar issues with the openssl command. At this point I'm even ready to read some RFC ( I hope it won't come to this :) )
Thanks in advance for help
Those file names represent different parts of the key generation and verification process. Please note that the names are just convention, you could just as easily call the files pepperoni.pizza and the content will be the same, so do be conscious of how you use the filenames.
A brief primer on PKI - Keys come in two halves, a public key and a private key. The public key can be distributed publicly and widely, and you can use it to verify, but not replicate, information generated using the private key. The private key must be kept secret.
.key files are generally the private key, used by the server to encrypt and package data for verification by clients.
.pem files are generally the public key, used by the client to verify and decrypt data sent by servers. PEM files could also be encoded private keys, so check the content if you're not sure.
.p12 files have both halves of the key embedded, so that administrators can easily manage halves of keys.
.cert or .crt files are the signed certificates -- basically the "magic" that allows certain sites to be marked as trustworthy by a third party.
.csr is a certificate signing request, a challenge used by a trusted third party to verify the ownership of a keypair without having direct access to the private key (this is what allows end users, who have no direct knowledge of your website, confident that the certificate is valid). In the self-signed scenario you will use the certificate signing request with your own private key to verify your private key (thus self-signed). Depending on your specific application, this might not be needed. (needed for web servers or RPC servers, but not much else).
A JKS keystore is a native file format for Java to store and manage some or all of the components above, and keep a database of related capabilities that are allowed or rejected for each key.
The commands you list look fine to me, and I don't see a question beyond asking what the different files are for. If you need more information, please enrich your question.
.key is the private key. This is accessible the key owner and no one else.
.csr is the certificate request. This is a request for a certificate authority to sign the key. (The key itself is not included.)
.crt is the certificate produced by the certificate authority that verifies the authenticity of the key. (The key itself is not included.) This is given to other parties, e.g. HTTPS client.
.pem is a text-based container using base-64 encoding. It could be any of the above files.
-----BEGIN EXAMPLE-----
...
-----END EXAMPLE-----
.p12 is a PKCS12 file, which is a container format usually used to combine the private key and certificate.
There isn't only one extension. For example you may see certificates with either the .crt or a .pem extension.
Just to add more info: .der, another (binary) encoding (either public or private key, or csr)
I have a trusted certificate chain, a certificate issued by this chain and private key file for this certificate.
I want to create a P12 / PFX for this, so I can put it as client certificate in the windows store:
OpenSsl Pkcs12 -export -nokeys
-certfile mytrustedCertifcates.pem^
-inkey myPrivateKey.Key^
-in myCertificate.crt^
-out myCertificate.P12
Alas, the resulting file contains all trustedCertificates. If I import the P12 in my windows certificate store, I import the complete certificate chain, although they are already in the certificate store.
I also tried options: (from OpenSsl command line utilities, also in -help)
-nocerts don't output certificates.
-clcerts only output client certificates.
Alas, the P12 still contains the complete certificate chain, and importing the P12 imports the complete chain again.
BartonJs gave the answer in a comment (thank you BartonJs!):
leave out the --certfile parameter:
OpenSsl Pkcs12 -export -nokeys
-name some friendly name
-inkey myPrivateKey.Key^
-in myCertificate.crt^
-out myCertificate.P12
nokeys: leaves out the PEM password
name: the friendly name that will appear in column friendly name of the winstore
inkey and in are the input certficate with its private key
out is the name of the file to produce.
After importing it in the windstore (command: certlm.msc), It propertly says:
Issued to:
Issued by:
Expiration date
Intended purposes
Friendly name:
I'm sure that this has been asked you several times, but solutions to that cases didn't work for me. So I need your help.
Consider x.root.cer is CA's certificate, x.app.cer is Application's certificate signed by CA's certificate, and x.app.private.pem is Application's private key.
I'm using following command in order to create pfx file (want to include both private key and certificate of application).
openssl pkcs12 -export -in x.app.cer -inkey x.app.private.pem -out x.app.pfx -certfile x.root.cer
Even though I know (can see) that 3 files are there, I'm getting the following error:
unable to load certificates
Can you please help me about this error?
Well, finally I suceeded with this command
openssl pkcs12 -export -in x.app.cer -inkey x.app.private.pem -out x.app.pfx
That means I shouldn't use -certfile parameter.