OpenSSL on Windows Server extract certificate chain from pfx

Question

I'm trying to upload our certificate to the AWS certificate store for use with CloudFront.

First I tried uploading it without the chain bundle. That resulted in an error when I tried to enable it on the CloudFront endpoint, saying that it didn't have a valid certificate chain.

So I tried to extract the certificate chain from the PFX archive with the following command:

openssl pkcs12 -in archive.pfx -nodes -nokeys -cacerts -passin pass:password | openssl x509 -chain -out bundle.crt

But it says unknown option -chain I have Googled a lot but everytime I open a page that explains how to extract chain bundle it says to use the -chain switch.

I thought maybe it would be enough to just try and upload the output of the first command. When I do that the AWS-CLI says the following:

Unable to validate certificate chain. The certificate chain must start with the immediate signing certificate, followed by any intermediaries in order. The index within the chain of the invalid certificate is: -1

Answer 1

OpenSSL doesn't put the certificates in the correct order when dumping a PKCS12 keystore, oddly enough.

Dump the certs to a PEM file:

openssl pkcs12 -in archive.pfx -nodes -nokeys \
  -passin pass:password -out chain.pem

Edit the file afterward to put them in correct order.

-chain is only valid for the pkcs12 subcommand and used when creating a PKCS12 keystore.