I have received a certificate from StartSSL for my domain in pure text which looks somewhat like:

-----BEGIN CERTIFICATE----- [...]Many letters and digits[...] -----END CERTIFICATE-----

I'm trying to create a .cer file from this text using instructions found here. Along with the certificate text, I also need to pass the private key text (correct me, if wrong) like this on OpenSSL command line:

openssl pkcs12 -export -out mycertkey.p12 -in certificate.txt -inkey key.txt

Update: The Create PKCS#12 (PFX) File option on StartSSL site also need private key in text. Tried as per Micheal's comment

As per recent conversation with StartSSL personnel, I tried generating .cer file on Converter website but there is no option of generating .cer file

As per my discussion email threads with StartSSL personnel, I believe that the private key is in my CSR but when I provided it as key using pkcs utility on OpenSSL tool, that gave me no fine results:

unable to load private key

Problem: How do I provide the private key text? I mean where is the private key text on StartSSL tool box? Or how do I extract it as text from my certificate?

  • 1
    The private key is wherever you stored it, when you made the certificate request. Aug 9, 2015 at 18:38
  • I have it in a .pfx file stored in `C:` drive. How do I extract that file's private key as text? Do you mean the certificate signing request? Aug 9, 2015 at 18:40
  • 1
    If you're trying to install a certificate to IIS, then just go back to StartSSL web site and use the Tool Box Create PKCS#12 file option to get your certificate. Aug 9, 2015 at 18:41
  • @MichealHampton - The generator tool also need private key (: Aug 9, 2015 at 18:45

1 Answer 1


You say you want to create a .cer file, but the instructions you link to don't do that. A .cer file normally contains only a certificate, or very rarely multiple certs, whereas the entire purpose of a .p12 or .pfx file (they are basically the same thing) is to contain a privatekey AND cert(s). If you are trying to run a SSL/TLS server (such as HTTPS but also LDAPS SMTPS FTPS etc), you do need both privatekey and cert(s), otherwise you usually don't.

The privatekey is used to generate the CSR, but is not in it; the CSR is sent to someone else, so it wouldn't be private. It's not at StartSSL because that wouldn't be private. It's not in your certificate because that wouldn't be private.

Look to see what is in your .pfx with openssl pkcs12 -in whatever.pfx -nodes. If the output contains at least a block beginning with a line -----BEGIN PRIVATE KEY----- followed by several lines all or nearly all letters and digits then a line -----END PRIVATE KEY----- you have some private key. (If using OpenSSL below version 1.0.0 it will say RSA PRIVATE KEY instead of just PRIVATE KEY.) If so, do: openssl pkcs12 -in whatever.pfx -nocerts -nodes -out key.txt. Now try the openssl pkcs12 -export in your question. If it doesn't give an error and doesn't say "No certificate matches private key" you have the right key. At this point the result can be imported to Windows store and used by e.g. IIS, or used directly by some programs e.g. Tomcat.

However, an SSL/TLS server SHOULD also have chain cert(s). CAs today mostly use one chain cert (as well as the root, which you don't need here); some use two or occasionally more. Which chain cert(s) is correct depends on what kind (validation and class) of cert you got; the StartSSL website should be able to tell you that. If you don't obtain and configure the correct chain cert(s), your server will run but clients will sometimes fail to connect to it, perhaps almost all the time, perhaps only rarely. Get the correct chain cert(s) in PEM format (the one you've already seen, with -----BEGIN CERTIFICATE----- through -----END CERTIFICATE-----) and put them in a file, e.g. chain.txt, and add -certfile chain.txt to your pkcs12 -export command.

PS- most people and examples use .pem not .txt as the extension for files in PEM format like these. The openssl software works either way, but it is more meaningful and helpful for people.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .