1. I extracted certificate using Chrome's SSL/export command.
  2. Then provided it as input to openvpn - in the config for openvpn:
    pkcs12 "path/to/pkcs12_container"
  3. When calling openvpn ~/openvp_config it asks for a password for private key (wich I entered when exporting using Chrome):
    Enter Private Key Password:...
  4. I want to remove this password request.

The question: how to remove the password for private key from pkcs12?

That is, create pkcs12 file which doesn't require a password.

(seems that I already somehow did this a year ago, and now forgot it.damn.)


6 Answers 6


It can be achieved by various openssl calls.

  • PASSWORD is your current password
  • YourPKCSFile is the file you want to convert
  • NewPKCSWithoutPassphraseFile is the target file for the PKCS12 without passphrase

First, extract the certificate:

$ openssl pkcs12 -clcerts -nokeys -in "YourPKCSFile" \
      -out certificate.crt -password pass:PASSWORD -passin pass:PASSWORD

Second, the CA key:

$ openssl pkcs12 -cacerts -nokeys -in "YourPKCSFile" \
      -out ca-cert.ca -password pass:PASSWORD -passin pass:PASSWORD

Now, the private key:

$ openssl pkcs12 -nocerts -in "YourPKCSFile" \
      -out private.key -password pass:PASSWORD -passin pass:PASSWORD \
      -passout pass:TemporaryPassword

Now remove the passphrase:

$ openssl rsa -in private.key -out "NewKeyFile.key" \
      -passin pass:TemporaryPassword

Put things together for the new PKCS-File:

$ cat "NewKeyFile.key"  \
      "certificate.crt" \
      "ca-cert.ca" > PEM.pem

And create the new file:

$ openssl pkcs12 -export -nodes -CAfile ca-cert.ca \
      -in PEM.pem -out "NewPKCSWithoutPassphraseFile"

Now you have a new PKCS12 key file without passphrase on the private key part.

  • awesome answer! ..what is ca-cert.ca?
    – Ayrat
    Jun 14, 2013 at 14:05
  • @Ayrat: This is the CA certificate part of your key. -- I have a typo in the answer, correcting... -- feel free to upvote and accept the answer after you tried it :-)
    – zero0
    Jun 14, 2013 at 14:06
  • 7
    -nodes is ignored when -export is used, it's not documented for this case (see openssl man page, -nodes is only listed when exporting from PKCS#12 to PEM). Your last call still prompts me for an export password. And If I just hit return, I get a PKCS#12 file whose password is an empty string and not one without a password. When I then do openssl pkcs12 -in "NewPKCSWithoutPassphraseFile" it still prompts me for an import password. I can just hit return and that works but if there was no password, it wouldn't even prompt.
    – Mecki
    Nov 28, 2018 at 15:56
  • I would upvote this one million times... Thanks!!
    – Neonigma
    Apr 15, 2020 at 6:25

The simplest solution I've found is

Export to temporary pem file

openssl pkcs12 -in protected.p12 -nodes -out temp.pem
#  -> Enter password

Convert pem back to p12

openssl pkcs12 -export -in temp.pem  -out unprotected.p12
# -> Just press [return] twice for no password

Remove temporary certificate

rm temp.pem
  • 1
    I don't see a downside to this approach. Oct 31, 2014 at 22:31
  • Some tools require a password. For example keytool -v -list -storetype pkcs12 -keystore unprotected.p12 will emit a warning and will NOT list the certificate. So it may work for OpenVPN, but not for something else.
    – mivk
    Nov 18, 2015 at 13:29
  • @mivk what do you mean? That some tools require a password protected key?
    – Koen.
    Nov 18, 2015 at 23:32
  • 1
    Sure, but the question is about removing the password, not about applications that require a password to be set.
    – Koen.
    Nov 19, 2015 at 12:43
  • 7
    Your solution doesn't create a PKCS#12 w/o a password but one with a password that is "" (emtpy string), which is not the same.
    – Mecki
    Nov 28, 2018 at 15:58

This can easily be done in one step with no temporary file:

openssl pkcs12 -in "PKCSFile" -nodes | openssl pkcs12 -export -out "PKCSFile-Nopass"

Answer the Import Password prompt with the password. Answer the Export Passowrd prompts with <CR>


Note that this handles any number of intermediate certificates that may be in the bundle...

I strongly recommend taking care with the resulting file; it would be a good idea to set umask to 377 first (non-unix: this means only owner can read file that's created.) I suppose that's 2 steps, if your default umask is permissive...


Now, the private key:

openssl pkcs12 -nocerts -in "YourPKCSFile" -out private.key -password pass:PASSWORD -passin pass:PASSWORD -passout pass:TemporaryPassword

Remove now the passphrase:

openssl rsa -in private.key -out "NewKeyFile.key" -passin pass:TemporaryPassword

The 2 steps may be replaced by

openssl pkcs12 -nocerts -in "YourPKCSFile" -out private.key -nodes

None of these worked for me. In the end I reverted to dotNet code which worked first time.

class Script
    static public void Main(string[] args)
                if (args.Length < 3 || args.Contains("/?"))
       string _infile = args[0],
                        _outfile = args[2];
                string _password = args[1], _outpassword = (args.Length > 3) ? args[3] : "";
                Console.WriteLine(String.Format("{0} -> {1} with ({2} -> {3})", _infile, _outfile, _password, _outpassword));
                System.Security.Cryptography.X509Certificates.X509Certificate2 cert = null;
                Console.WriteLine(String.Format("Load {0} with {2}", _infile, _outfile, _password, _outpassword));
                cert = new System.Security.Cryptography.X509Certificates.X509Certificate2(_infile, _password, System.Security.Cryptography.X509Certificates.X509KeyStorageFlags.Exportable);
                Console.WriteLine(String.Format("Export {1} with {3}", _infile, _outfile, _password, _outpassword));
                System.IO.File.WriteAllBytes(_outfile, cert.Export(System.Security.Cryptography.X509Certificates.X509ContentType.Pfx, _outpassword));
                Console.WriteLine(String.Format("Export complete", _infile, _outfile, _password, _outpassword));

     static public void MainHelp(string[] args)
            Console.WriteLine("Usage pfxremovepwd [inpfx] [inpwd] [outpfx] [optional outpwd]");

Here's a pure PowerShell solution that works without OpenSSL:

Install-Module -Name 'Carbon.Cryptography'
$password = Read-Host -AsSecureString
$cert = Get-CCertificate -Path PATH -Password $password -KeyStorageFlags Exportable
[IO.File]::WriteAllBytes(OUT_PATH, $cert.Export('Pfx'))

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.