I'm trying to upload our certificate to the AWS certificate store for use with CloudFront.

First I tried uploading it without the chain bundle. That resulted in an error when I tried to enable it on the CloudFront endpoint, saying that it didn't have a valid certificate chain.

So I tried to extract the certificate chain from the PFX archive with the following command:

openssl pkcs12 -in archive.pfx -nodes -nokeys -cacerts -passin pass:password | openssl x509 -chain -out bundle.crt

But it says unknown option -chain I have Googled a lot but everytime I open a page that explains how to extract chain bundle it says to use the -chain switch.

I thought maybe it would be enough to just try and upload the output of the first command. When I do that the AWS-CLI says the following:

Unable to validate certificate chain. The certificate chain must start with the immediate signing certificate, followed by any intermediaries in order. The index within the chain of the invalid certificate is: -1

1 Answer 1


OpenSSL doesn't put the certificates in the correct order when dumping a PKCS12 keystore, oddly enough.

Dump the certs to a PEM file:

openssl pkcs12 -in archive.pfx -nodes -nokeys \
  -passin pass:password -out chain.pem

Edit the file afterward to put them in correct order.

-chain is only valid for the pkcs12 subcommand and used when creating a PKCS12 keystore.

  • I found that it was the inverted order of the chain. Thank you!
    – Feanaro
    Jul 20, 2015 at 17:51
  • So what order should be? any details?
    – BMW
    Aug 13, 2018 at 0:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.