I have a bit9 server, and I'm fairly new to the environment, as well as certs. The area to upload the cert says "Import Server Certificate From PKCS12 File"

I'm going to just use a self signed cert (I'm hoping it's ok with that), and I'm running the below command to do so.

openssl req -x509 -newkey rsa:4096 -keyout bit9.pem -out cert.pem -days 365

Is that what I should have done, and if so, how do I get this to a PKCS12 File?

I've been looking around, and found the below command:

Convert a PEM certificate file and a private key to PKCS#12

openssl pkcs12 -export -out <certificate.pfx> -inkey <privateKey.key> -in <certificate.crt> -certfile <CACert.crt>

Since I only have a pem file...I'm not sure how to do this.

1 Answer 1


I found steps that led to the solution here.

Since the answer is spread out across the question, and the answer, I'll just put exactly what I did below.

Create the key and cert (-nodes creates without password, means no DES encryption [thanks to jewbix.cube for correction])

openssl req -x509 -newkey rsa:4096 -keyout myKey.pem -out cert.pem -days 365 -nodes

Create pkcs12 file

openssl pkcs12 -export -out keyStore.p12 -inkey myKey.pem -in cert.pem
  • 9
    I think -nodes means "no DES". as in no DES encryption. Sep 17, 2020 at 17:56
  • the -nodes is deprecated, use -noenc instead Oct 26, 2023 at 10:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .