1. I extracted certificate using Chrome's SSL/export command.
  2. Then provided it as input to openvpn - in the config for openvpn:
    pkcs12 "path/to/pkcs12_container"
  3. When calling openvpn ~/openvp_config it asks for a password for private key (wich I entered when exporting using Chrome):
    Enter Private Key Password:...
  4. I want to remove this password request.

The question: how to remove the password for private key from pkcs12?

That is, create pkcs12 file which doesn't require a password.

(seems that I already somehow did this a year ago, and now forgot it.damn.)

up vote 39 down vote accepted

It can be achieved by various openssl calls.

  • PASSWORD is your current password
  • YourPKCSFile is the file you want to convert
  • NewPKCSWithoutPassphraseFile is the target file for the PKCS12 without passphrase

First, extract the certificate:

$ openssl pkcs12 -clcerts -nokeys -in "YourPKCSFile" \
      -out certificate.crt -password pass:PASSWORD -passin pass:PASSWORD

Second, the CA key:

$ openssl pkcs12 -cacerts -nokeys -in "YourPKCSFile" \
      -out ca-cert.ca -password pass:PASSWORD -passin pass:PASSWORD

Now, the private key:

$ openssl pkcs12 -nocerts -in "YourPKCSFile" \
      -out private.key -password pass:PASSWORD -passin pass:PASSWORD \
      -passout pass:TemporaryPassword

Now remove the passphrase:

$ openssl rsa -in private.key -out "NewKeyFile.key" \
      -passin pass:TemporaryPassword

Put things together for the new PKCS-File:

$ cat "NewKeyFile.key"  \
      "certificate.crt" \
      "ca-cert.ca" > PEM.pem

And create the new file:

$ openssl pkcs12 -export -nodes -CAfile ca-cert.ca \
      -in PEM.pem -out "NewPKCSWithoutPassphraseFile"

Now you have a new PKCS12 key file without passphrase on the private key part.

  • awesome answer! ..what is ca-cert.ca? – Ayrat Jun 14 '13 at 14:05
  • @Ayrat: This is the CA certificate part of your key. -- I have a typo in the answer, correcting... -- feel free to upvote and accept the answer after you tried it :-) – zero0 Jun 14 '13 at 14:06
  • -nodes is ignored when -export is used, it's not documented for this case (see openssl man page, -nodes is only listed when exporting from PKCS#12 to PEM). Your last call still prompts me for an export password. And If I just hit return, I get a PKCS#12 file whose password is an empty string and not one without a password. When I then do openssl pkcs12 -in "NewPKCSWithoutPassphraseFile" it still prompts me for an import password. I can just hit return and that works but if there was no password, it wouldn't even prompt. – Mecki Nov 28 at 15:56

The simplest solution I've found is

Export to temporary pem file

openssl pkcs12 -in protected.p12 -nodes -out temp.pem
#  -> Enter password

Convert pem back to p12

openssl pkcs12 -export -in temp.pem  -out unprotected.p12
# -> Just press [return] twice for no password

Remove temporary certificate

rm temp.pem
  • I don't see a downside to this approach. – Matt Beckman Oct 31 '14 at 22:31
  • Some tools require a password. For example keytool -v -list -storetype pkcs12 -keystore unprotected.p12 will emit a warning and will NOT list the certificate. So it may work for OpenVPN, but not for something else. – mivk Nov 18 '15 at 13:29
  • @mivk what do you mean? That some tools require a password protected key? – Koen. Nov 18 '15 at 23:32
  • @Koen : yes. Apparently, keytool (and probably other Java applications?) refuses to list certs in a pkcs12 container which was created with an empty export password. But I understand that OpenVPN doesn't care. So it just means: if you made it with an empty password, check that it actually works in your application. – mivk Nov 19 '15 at 12:30
  • 1
    Sure, but the question is about removing the password, not about applications that require a password to be set. – Koen. Nov 19 '15 at 12:43

This can easily be done in one step with no temporary file:

openssl pkcs12 -in "PKCSFile" -nodes | openssl pkcs12 -export -out "PKCSFile-Nopass"

Answer the Import Password prompt with the password. Answer the Export Passowrd prompts with <CR>


Note that this handles any number of intermediate certificates that may be in the bundle...

I strongly recommend taking care with the resulting file; it would be a good idea to set umask to 377 first (non-unix: this means only owner can read file that's created.) I suppose that's 2 steps, if your default umask is permissive...

Now, the private key:

openssl pkcs12 -nocerts -in "YourPKCSFile" -out private.key -password pass:PASSWORD -passin pass:PASSWORD -passout pass:TemporaryPassword

Remove now the passphrase:

openssl rsa -in private.key -out "NewKeyFile.key" -passin pass:TemporaryPassword

The 2 steps may be replaced by

openssl pkcs12 -nocerts -in "YourPKCSFile" -out private.key -nodes

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.