Client certificate works in Firefox in .p12 format, but not with .pem

Question

I needed to convert a client certificate .p12 file to .pem and I did it with the following command:

openssl pkcs12 -in combo.p12 -out combo.pem

Importing .p12 to Firefox for test works, I am asked for my passphrase and after entering my data it's then imported, but importing the .pem file does nothing, just nothing happens.

Format of my produced .pem certificate (... for sensitive data):

Bag Attributes
   friendlyName: cn=...
   localKeyID: ...
Key Attributes: <No Attributes>
-----BEGIN ENCRYPTED PRIVATE KEY-----

(my encrypted data)

-----END ENCRYPTED PRIVATE KEY-----
Bag Attributes
   friendlyName: cn=...
   localKeyID: ... 
subject=C = ....

issuer=....

-----BEGIN CERTIFICATE-----

(my encrypted data)

 -----END CERTIFICATE-----

The source here https://knowledge.digicert.com/solution/SO5437.html says Firefox should support both .pem and .p12 and Firefox import file prompt offers "PKCS12 File" and "Certificate File" options in the file filter menu.

I can also use .p12 with PHP (CURL) and SoapUI and not my .pem file (SoapClient) with either.

Alternatively, if this isn't really an issue, how can I verify if my .pem file is fine? I tried:

openssl verify combo.pem

returns

error 20 at 9 depth lookup: unable to get local issuer certificate
error combo.pem: verification failed

Answer 1

A pem file can hold different parts of the certificates - and thus you can have different ways to build one. In your case - the error you get implies that you are missing the issuer certificate to verify the trust of your certificate.

So try adding the full chain into the pem in this way:

-----BEGIN RSA PRIVATE KEY-----

(Your Private Key: your_client.key)

-----END RSA PRIVATE KEY-----

-----BEGIN CERTIFICATE-----

(Your Primary SSL certificate: your_client.crt)

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

(Your Intermediate certificate: your_Issuer.crt)

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

(Your Root certificate: Your_Root.crt)

-----END CERTIFICATE-----