61

On Ubuntu, I cannot convert certificate using openssl successfully.

vagrant@dev:/vagrant/keys$ openssl pkcs7 -print_certs -in a.p7b -out a.cer 
unable to load PKCS7 object <blah blah>:PEM
routines:PEM_read_bio:no start line:pem_lib.c:696:Expecting: PKCS7

Have you seen this error before?

5
  • Are you sure the file is a p7b?
    – Zoredache
    Aug 13, 2012 at 19:52
  • Was the file moved between servers or uploaded via FTP? If it is indeed the correct format, it seems as though it may have become corrupted. Try re-transferring the file to the server in binary mode (if using FTP) or re-copy it from the source.
    – Garrett
    Aug 13, 2012 at 20:01
  • I say it's a p7b based on the file's suffix. I re-downloaded it via Firefox, but I still got the same OpenSSL error... Aug 13, 2012 at 20:30
  • 1
    @Kevin What does file a.p7b give you?
    – user89350
    Aug 13, 2012 at 20:37
  • @NicYoung - I just get the above error message. No output. Aug 13, 2012 at 20:45

9 Answers 9

78

Try this:

$ openssl pkcs7 -inform der -in a.p7b -out a.cer

If it doesn't work, brings to a Windows machine and export follow this guide.

4
  • 14
    Note the the OP had the parameter -print_certs in its command. It impacts the output format: with it you get a PEM format (starting with -----BEGIN CERTIFICATE-----), and without it you get a PKCS#7 format (-----BEGIN PKCS7-----)
    – Sylvain B
    Mar 14, 2018 at 16:36
  • This only works if I drop the -inform der part. Note also that while exporting a key from Windows Cert Manager, DER and P7B are two distinct options.
    – jpaugh
    Oct 17, 2019 at 20:03
  • 2
    If you can open the p7b with a text editor and see ----- BEGIN PKCS7 ----- then you have a pem formatted p7b. In this case, you dont want to use -inform der because that tells openssl to expect a binary file, but this is in text (base64) format. You can read more about the differences between PEM and DER here.
    – Rex Linder
    Mar 10, 2021 at 21:49
  • This is the accepted answer, but it is wrong, as Sylvain B explains. Apparently this changed in newer versions of openssl.Shall we edit it? Jun 23 at 8:33
37

So to combine the above answers, the command is:
openssl pkcs7 -in cert.p7b -inform DER -print_certs -out cert.pem

Verified to be working on Windows, using OpenSSL-Win64

/Thanks Bogdan for spotting the error

0
10

I followed this guide that instructs you to change the header/footer lines from

-----BEGIN PKCS #7 SIGNED DATA-----
[data]
-----END PKCS #7 SIGNED DATA-----

to

-----BEGIN CERTIFICATE-----
[data]
-----END CERTIFICATE-----

Then run the command openssl pkcs7 -in foo.modified.crt -print_certs -out foo.certs (where foo.modified.crt is the file that you saved the modified version into). This gave me the same results as running through a Windows certificate export as suggested in other answers.

0
7

As far as I know, the following should convert a pkcs7 cert to a pem

openssl pkcs7 -in certificate_file.p7b -print_certs -out cert.pem
2
  • 1
    Why do you mean this answer is related to this thread ? Because as you see. It's same as above.
    – ms_devel
    Jun 8, 2018 at 9:40
  • You did not answer why OP is getting an error. Feb 10, 2020 at 22:15
4

quick solution in my case (a lot of files with missing header/footer) :

base64 -d $FILE | openssl pkcs7 -inform DER -print_certs

2
  • 2
    I had a base64 encoded certificate and I knew nothing more about it and the base64 -d command saved me a lot of trouble. This solution should be more readily available in search results. Thank you!
    – user391905
    Mar 21, 2017 at 8:49
  • You just saved a man from suicide Nov 20, 2020 at 8:36
2

I had this problem too. I was going to verify a p7b file I copied from a Win7 host.

I found out that gnome keyring can import the certificate. From there it's easy to export to DER

2
# Decode base64 encoded string into DER-encoded binary
base64 --decode signature > signature.cer
# Convert DER-encoded binary to PEM-encoded P7B
openssl pkcs7 -inform der -in signature.cer -out signature.p7b
# Convert PEM-encoded P7B to PEM-encoded CRT
openssl pkcs7 -print_certs -in signature.p7b -out signature.crt

# OR: Convert DER-encoded binary to PEM-encoded CRT
openssl pkcs7 -print_certs -inform der -in signature.cer -out signature.crt
# signature.p7b
-----BEGIN PKCS7-----
[...]
-----END PKCS7-----
# signature.crt
subject=[...]
issuer=[...]
-----BEGIN CERTIFICATE-----
[...]
-----END CERTIFICATE-----
# Read contents in PEM-encoded CRT
keytool -printcert -file signature.crt
0

openssl pkcs7 -print_certs -in intermediates.p7b -out intermediates.cer

My source file was in text with -----BEGIN PKCS7----- as the header... This method worked for me while others did not.

2
  • Is this an Answer or a Comment?
    – djdomi
    Jul 15, 2021 at 4:50
  • Does this belong here at all? This is exactly what the OP said did not work. Saying it worked for you is not very helpful. Jul 15, 2021 at 14:43
0

If you get the following error:

unable to load PKCS7 object
140368561349952:error:0909006C:PEM routines:get_name:no start line:../crypto/pem/pem_lib.c:745:Expecting: PKCS7

make sure the content of the p7b in below format (-----BEGIN PKCS7----- and -----END PKCS7----- in separate lines).

Before:

-----BEGIN PKCS7-----CONTENT-----END PKCS7-----

After:

-----BEGIN PKCS7-----
CONTENT
-----END PKCS7-----

Converting from P7B to PFX format.

openssl pkcs7 -print_certs -in domain.p7b -out domain.cer

openssl pkcs12 -export -out domain.pfx -in domain.cer -inkey domain.key -passout pass:REAL_PASSWORD
1
  • If you have a new question, please ask it by clicking the Ask Question button. Include a link to this question if it helps provide context. - From Review
    – djdomi
    Jun 10 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.