Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Note : This is not really a question because I already found the answer but since I didn't find it easily here I will post it so that it can benefit others.

Question : How to read a concatenated PEM file as the one used by apache/mod_ssl directive SSLCACertificateFile ?

Answer (original) (source) :

cat $file|awk 'split_after==1{n++;split_after=0} /-----END CERTIFICATE-----/ {split_after=1} {print > "cert" n ".pem"}'

Answer 29/03/2016 :

Following @slugchewer answer, csplit might be a clearer option with :

csplit -f cert- $file '/-----BEGIN CERTIFICATE-----/' '{*}'
share|improve this question
This may be a dumb question, but why would I need to split my pem file? – Ashwani Agarwal Mar 26 at 8:06
@AshwaniAgarwal You want to split a PEM file when it contains several certificates and you wish to examine the certificates individually with tools such as openssl that take one certificate to analyze. – Law29 Mar 26 at 9:13
up vote 11 down vote accepted

This was previously answered on StackOverflow :

awk '
  split_after == 1 {n++;split_after=0}
  /-----END CERTIFICATE-----/ {split_after=1}
  {print > "cert" n ".pem"}' < $file

Edit 29/03/2016 : See @slugchewer answer

share|improve this answer
Works on Linux only, fails on FreeBSD. – Michael-O Jan 7 '15 at 22:07
Inspired by this I've created an awk script that splits out certs and keys into separate files: – JinnKo Mar 23 '15 at 18:12

The awk snippet works for extracting the different parts, but you still need to know which section is the key / cert / chain. I needed to extract a specific section, and found this on the OpenSSL mailinglist:

# Extract key
openssl pkey -in foo.pem -out foo-key.pem

# Extract chain
openssl crl2pkcs7 -nocrl -certfile foo.pem |
  openssl pkcs7 -print_certs -out foo-chain.pem

# Extract cert
openssl x509 -in foo.pem -outform DER -out foo-cert.pem
share|improve this answer
nice command set :) I'll keep it for future use, but in my use case above, I'm working with a cert-only file containing 50+ CA certs ==> no pkey nor chain – Cerber Mar 20 '15 at 12:42
I think this is superior to awk solution, let the openssl do the parsing + you get the conversion. – Rusty Mar 24 at 16:22

The split command is available on most systems, and its invocation is likely easier to remember.

If you have a file collection.pem that you want to split into individual-* files, use:

split -p "-----BEGIN CERTIFICATE-----" collection.pem individual-

If you don't have split, you could try csplit:

csplit -f individual- collection.pem '/-----BEGIN CERTIFICATE-----/' '{*}'
share|improve this answer
Sorry, none of my systems (busybox, fedora, centos) show a -p option (nor the manpages I read) on split. Maybe you're using a special binary / package – Cerber Mar 25 at 10:25
@Cerber Could try csplit instead... (see edit above) – slugchewer Mar 26 at 5:33
works fine with csplit ! – Cerber Mar 29 at 8:52

Also worth noting that PEM files are just a collection of keys/certificates inside BEGIN/END blocks, so it's pretty easy to just cut/paste if it's just a single file with one or two interesting entities...

share|improve this answer

If you want to get a single certificate out of a multi-certificate PEM bundle, try:

$ openssl crl2pkcs7 -nocrl -certfile INPUT.PEM | \
    openssl pkcs7 -print_certs | \
    awk '/subject.*,/END CERTIFICATE/'
  • The first two openssl commands will process a PEM file and and spit it back out with pre-pended "subject:" and "issuer:" lines before each cert. If your PEM is already formatted this way, all you need is the final awk command.
  • The awk command will spit out the individual PEM matching the CN (common name) string.

source1 , source2

share|improve this answer
I don't see this in your source. Beside, PEM are Base64 encoded you won't find text like "subject", "CN", ... with awk – Cerber May 12 at 9:29
Yes, this doesn't work for every type of PEM. If you extract a P7B to PEM using openssl, it will have a subject line listed before each certificate. Or you can modify to any string you segment your PEM file with. – cmcginty May 12 at 9:54
Updated answer to handle when PEM does not contain "subject" – cmcginty May 13 at 1:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.