70

On Ubuntu, I cannot convert certificate using openssl successfully.

vagrant@dev:/vagrant/keys$ openssl pkcs7 -print_certs -in a.p7b -out a.cer 
unable to load PKCS7 object <blah blah>:PEM
routines:PEM_read_bio:no start line:pem_lib.c:696:Expecting: PKCS7

Have you seen this error before?

5
  • Are you sure the file is a p7b?
    – Zoredache
    Aug 13, 2012 at 19:52
  • Was the file moved between servers or uploaded via FTP? If it is indeed the correct format, it seems as though it may have become corrupted. Try re-transferring the file to the server in binary mode (if using FTP) or re-copy it from the source.
    – Garrett
    Aug 13, 2012 at 20:01
  • I say it's a p7b based on the file's suffix. I re-downloaded it via Firefox, but I still got the same OpenSSL error... Aug 13, 2012 at 20:30
  • 1
    @Kevin What does file a.p7b give you?
    – user89350
    Aug 13, 2012 at 20:37
  • @NicYoung - I just get the above error message. No output. Aug 13, 2012 at 20:45

9 Answers 9

84

Try this:

$ openssl pkcs7 -inform der -in a.p7b -out a.cer

If it doesn't work, brings to a Windows machine and export follow this guide.

4
  • 15
    Note the the OP had the parameter -print_certs in its command. It impacts the output format: with it you get a PEM format (starting with -----BEGIN CERTIFICATE-----), and without it you get a PKCS#7 format (-----BEGIN PKCS7-----)
    – Sylvain B
    Mar 14, 2018 at 16:36
  • This only works if I drop the -inform der part. Note also that while exporting a key from Windows Cert Manager, DER and P7B are two distinct options.
    – jpaugh
    Oct 17, 2019 at 20:03
  • 2
    If you can open the p7b with a text editor and see ----- BEGIN PKCS7 ----- then you have a pem formatted p7b. In this case, you dont want to use -inform der because that tells openssl to expect a binary file, but this is in text (base64) format. You can read more about the differences between PEM and DER here.
    – Rex Linder
    Mar 10, 2021 at 21:49
  • This is the accepted answer, but it is wrong, as Sylvain B explains. Apparently this changed in newer versions of openssl.Shall we edit it? Jun 23, 2022 at 8:33
45

So to combine the above answers, the command is:
openssl pkcs7 -in cert.p7b -inform DER -print_certs -out cert.pem

Verified to be working on Windows, using OpenSSL-Win64

/Thanks Bogdan for spotting the error

1
  • 1
    Works on Linux with OpenSSL 3.0.2
    – Orphans
    Mar 20, 2023 at 13:32
10

I followed this guide that instructs you to change the header/footer lines from

-----BEGIN PKCS #7 SIGNED DATA-----
[data]
-----END PKCS #7 SIGNED DATA-----

to

-----BEGIN CERTIFICATE-----
[data]
-----END CERTIFICATE-----

Then run the command openssl pkcs7 -in foo.modified.crt -print_certs -out foo.certs (where foo.modified.crt is the file that you saved the modified version into). This gave me the same results as running through a Windows certificate export as suggested in other answers.

0
8

As far as I know, the following should convert a pkcs7 cert to a pem

openssl pkcs7 -in certificate_file.p7b -print_certs -out cert.pem
2
  • 1
    Why do you mean this answer is related to this thread ? Because as you see. It's same as above.
    – ms_devel
    Jun 8, 2018 at 9:40
  • You did not answer why OP is getting an error. Feb 10, 2020 at 22:15
7

quick solution in my case (a lot of files with missing header/footer) :

base64 -d $FILE | openssl pkcs7 -inform DER -print_certs

3
  • 2
    I had a base64 encoded certificate and I knew nothing more about it and the base64 -d command saved me a lot of trouble. This solution should be more readily available in search results. Thank you!
    – user391905
    Mar 21, 2017 at 8:49
  • You just saved a man from suicide Nov 20, 2020 at 8:36
  • I was having problem in linux. base64 -d $FILE fixed the problem. Sep 13, 2023 at 10:56
3
# Decode base64 encoded string into DER-encoded binary
base64 --decode signature > signature.cer
# Convert DER-encoded binary to PEM-encoded P7B
openssl pkcs7 -inform der -in signature.cer -out signature.p7b
# Convert PEM-encoded P7B to PEM-encoded CRT
openssl pkcs7 -print_certs -in signature.p7b -out signature.crt

# OR: Convert DER-encoded binary to PEM-encoded CRT
openssl pkcs7 -print_certs -inform der -in signature.cer -out signature.crt
# signature.p7b
-----BEGIN PKCS7-----
[...]
-----END PKCS7-----
# signature.crt
subject=[...]
issuer=[...]
-----BEGIN CERTIFICATE-----
[...]
-----END CERTIFICATE-----
# Read contents in PEM-encoded CRT
keytool -printcert -file signature.crt
2

I had this problem too. I was going to verify a p7b file I copied from a Win7 host.

I found out that gnome keyring can import the certificate. From there it's easy to export to DER

0

openssl pkcs7 -print_certs -in intermediates.p7b -out intermediates.cer

My source file was in text with -----BEGIN PKCS7----- as the header... This method worked for me while others did not.

2
  • Is this an Answer or a Comment?
    – djdomi
    Jul 15, 2021 at 4:50
  • 1
    Does this belong here at all? This is exactly what the OP said did not work. Saying it worked for you is not very helpful. Jul 15, 2021 at 14:43
0

If you get the following error:

unable to load PKCS7 object
140368561349952:error:0909006C:PEM routines:get_name:no start line:../crypto/pem/pem_lib.c:745:Expecting: PKCS7

make sure the content of the p7b in below format (-----BEGIN PKCS7----- and -----END PKCS7----- in separate lines).

Before:

-----BEGIN PKCS7-----CONTENT-----END PKCS7-----

After:

-----BEGIN PKCS7-----
CONTENT
-----END PKCS7-----

Converting from P7B to PFX format.

openssl pkcs7 -print_certs -in domain.p7b -out domain.cer

openssl pkcs12 -export -out domain.pfx -in domain.cer -inkey domain.key -passout pass:REAL_PASSWORD
1
  • If you have a new question, please ask it by clicking the Ask Question button. Include a link to this question if it helps provide context. - From Review
    – djdomi
    Jun 10, 2022 at 18:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .