Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been using the openssl pkcs12 command to pack my certs/keys up for Windows 8,

openssl pkcs12 -export         \
    -in win8client-cert.pem    \
    -inkey win8client-key.pem  \
    -certfile ca-cert.pem      \
    -out win8client.p12                                                                                                                           

However, I'm not entirely clear what it does. If I'm feeding it the -certfile why is that the certfile must also be manually installed on the host machine (a Windows 8 box)? When I take the .p12 and extract the cacert (using the Certificates MMC on Windows) I can install it on the host box and everything works fine.

Why can't it just get the CA cert form the .p12 (which is just a packing format by my understanding).

share|improve this question

The Certificates MMC, when importing a PKCS#12 file, puts all certificates in the Personal/Certificates folder, even the CA certificate. The problem is that CA certificates have to be located in the Trusted Root Certification Authorities/Certificates folder to be actually used as root in a certificate chain verification. Therefore, if you manually move the certificate to that folder after importing the PKCS#12 container everything should work as expected.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.