Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
  1. I extracted certificate using Chrome's SSL/export command.
  2. Then provided it as input to openvpn - in the config for openvpn:
    pkcs12 "path/to/pkcs12_container"
  3. When calling openvpn ~/openvp_config it asks for a password for private key (wich I entered when exporting using Chrome):
    Enter Private Key Password:...
  4. I want to remove this password request.

The question: how to remove the password for private key from pkcs12?

That is, create pkcs12 file which doesn't require a password.

(seems that I already somehow did this a year ago, and now forgot it.damn.)

share|improve this question
    
the following script does this (essentially it is zero0 answer): gist.github.com/5nizza/7ae9cff0d43f33818a33 usage: ./remove_pass_from_cert.sh YourCertName YourCertPass –  Ayrat Jun 10 at 13:53

3 Answers 3

up vote 5 down vote accepted

It can be achieved by various openssl calls.

  • PASSWORD is your current password
  • YourPKCSFile is the file you want to convert
  • NewPKCSWithoutPassphraseFile is the target file for the PKCS12 without passphrase

First, extract the certificate:

openssl pkcs12 -clcerts -nokeys -in "YourPKCSFile" -out certificate.crt -password pass:PASSWORD -passin pass:PASSWORD

Second, the CA key:

openssl pkcs12 -cacerts -nokeys -in "YourPKCSFile" -out ca-cert.ca -password pass:PASSWORD -passin pass:PASSWORD

Now, the private key:

openssl pkcs12 -nocerts -in "YourPKCSFile" -out private.key -password pass:PASSWORD -passin pass:PASSWORD -passout pass:TemporaryPassword

Remove now the passphrase:

openssl rsa -in private.key -out "NewKeyFile.key" -passin pass:TemporaryPassword

Put things together for the new PKCS-File:

cat "NewKeyFile.key" > PEM.pem

cat "certificate.crt" >> PEM.pem

cat "ca-cert.ca" >> PEM.pem

And create the new file:

openssl pkcs12 -export -nodes -CAfile ca-cert.ca -in PEM.pem -out "NewPKCSWithoutPassphraseFile"

Now you have a new PKCS12 key file without passphrase on the private key part.

share|improve this answer
    
awesome answer! ..what is ca-cert.ca? –  Ayrat Jun 14 '13 at 14:05
    
@Ayrat: This is the CA certificate part of your key. -- I have a typo in the answer, correcting... -- feel free to upvote and accept the answer after you tried it :-) –  zero0 Jun 14 '13 at 14:06
    
thanks! it works! (sorry, but don't have enough reputation to upvote your answer.) –  Ayrat Jun 14 '13 at 14:10

The simplest solution I've found is

Export to temporary pem file

openssl pkcs12 -in protected.p12 -nodes -out temp.pem
#  -> Enter password

Convert pem back to p12

openssl pkcs12 -export -in temp.pem  -out unprotected.p12
# -> Just press [return] twice for no password

Remove temporary certificate

rm temp.pem
share|improve this answer
    
I don't see a downside to this approach. –  Matt Beckman Oct 31 at 22:31

Now, the private key:

openssl pkcs12 -nocerts -in "YourPKCSFile" -out private.key -password pass:PASSWORD -passin pass:PASSWORD -passout pass:TemporaryPassword

Remove now the passphrase:

openssl rsa -in private.key -out "NewKeyFile.key" -passin pass:TemporaryPassword

The 2 steps may be replaced by

openssl pkcs12 -nocerts -in "YourPKCSFile" -out private.key -nodes
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.