Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a PEM RSA private key generated with opendkim:

# dkim-genkey -t -s code001 -d domain.com

and for use it with exchange, i need to convert it to pfx with this command:

# openssl pkcs12 -export -in code001.private -nodes -out code001.pfx -nokeys
Enter Export Password:
Verifying - Enter Export Password:
4192275:error:0D0C6070:asn1 encoding routines:ASN1_item_pack:encode error:asn_pack.c:170:

but i receive this error, and i don't know if this is the correct way to do that.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

It fails because code001.private only contains an RSA key, while pkcs12 expects a certificate to go with it. In addition, as said by Stephane, the -nokeys option will cause openssl to skip the private key.

You can generate a certificate with

openssl req -new -x509 -key code001.private -out code001.pem

and fill in the interactive questions, then generate the pfx with

cat code001.private code001.pem |openssl pkcs12 -export -out code001.pfx
share|improve this answer
    
Works perfect, i had this problem several days, really thanks –  Ricardo Fraile May 7 '13 at 10:42

the -nokeys parameter will cause OpenSSL not to include any private key in the output and the -nodesparameter will ask it not to encrypt any private key. This is not going to result in a usable PKCS#12 file anyway.

Try it with:

openssl pkcs12 -export -in code001.private -out code001.pfx
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.