13

I have an SSL certificate in .p7b format that I need to convert to .pfx. If I try this through the windows certificate managment the option to expert as a .pfx is disabled.

Trying with openssl I have found the following two commands to do the conversion:

openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer
openssl pkcs12 -export -in certificate.cer -inkey privateKey.key -out certificate.pfx -certfile CACert.cer

but I'm not sure what key to use for teh esecond command, or what certificate CACert.cer refers to.

How can I convert this key to .pfx format?

Improve this question

5 Answers 5

Reset to default
20

PKCS#7 does not include the private (key) part of a certificate/private-key pair, it is commonly used for certificate dissemination (e.g. as the response to a PKCS#10 certificate request, as a means to distribute S/MIME certs used to encrypt messages, or to validate signed messages etc). It is important to remember that it is only for certificates which are by definition public items.

PKCS#12 is a more universal container - it is intended to store both the private key and public certificate parts together so that they can be moved around. It has the capability of being password protected to provide some protection to the keys.

PFX was the predecessor of PKCS#12.

You cannot (as Anitak points out) convert from PKCS#7 to PKCS#12 without additional data (the private key part) because PKCS#7 doesn't have all of the data.

Mark Sutton has pointed out why you are unable to export as PFX - the certificate in question has its private key flagged as non-exportable. The Cryptographic Service Provider (CSP)will not allow that key to be moved, this is intentional. The only* way you can get an exportable cert\key pair is if the original Certificate was issued with the exportable flag set. It is also possible that there is no private key associated with the cert but I'm assuming that that is not the case here.

There is a good summary of the various PKCS types on Wikipedia.

  • The only legitimate way at least. Depending on the CSP\Crypto Hardware there may be mechanisms, especially for software only CSP's, but that's an area for security vulnerability research only as far as I'm concerned, not systems admin.
Improve this answer
1
  • Thanks - looks like buying a new certificate may be cheaper than recovering it, based on the amount of time we'll have to deal with a third-party to do this.
    – DrStalker
    Nov 10, 2009 at 23:56
15

I go through this every 2 years (when I renew a code-signing cert) and it's a pain each time.

A key piece of info is that you can simply rename .p7b files to .spc (as stated here: http://support.microsoft.com/kb/269395).

You can then use the pvk2pfx.exe tool to convert your PVK + SPC into a PFX.

pvk2pfx.exe -pvk input.pvk -pi <existing_input.pvk_password> -spc input.spc -pfx output.pfx -po <new_output.pfx_password>

(you may be able to skip the p7b renaming step & use it directly; I haven't tried...)

Improve this answer
1
  • this is far more useful than the accepted answer. I am amazed at the state of the code signing nonsense. I cringe at the thought of having to repeat this over and over when the certificates expire.
    – Tim
    Apr 27, 2011 at 3:15
3

With the windows tool if the pfx option is disabled it means that the private key is not able to be exported from the local store. This is either because its not there (because the keys weren't generated on the box your using) or because when you generated the keys the private key was not marked as exportable and the windows certificate template was not configured to allow export.

I'm assuming your using a Microsoft certificate authority to issue your certificates. Is this correct?

If so then:-

1.Make sure that the certificate template allows the export of private keys.
2.How are you generating your certificate request, you can use the following technique

CREATE INF file as follows

[Version]
Signature="$Windows NT$

[NewRequest]
Subject="etc"
KeySpec=1
Exportable=1
MachineKeySet=TRUE
ProviderName="CSPName"
ProviderType=1

[RequestAttributes] CertificateTemplate=

NOTE the Exportable =1
Then use the fllowing commands at the command prompt

certreq -new infile.inf reqfile.req //where infile.inf is the file above and reqfile is the output request file

certreq -submit -config \ reqfile.req //Submits the cert request to the CA

Once this is complete you will be able to export the cert as a pfx

Alternatively goto http://www.blacktipconsulting.com/Site/Products.html where i've put my free command line tool that does all this for you and exports the cert as pfx once finished

Improve this answer
2

I could be wrong, but I think your PCKCS#7 file only includes the public half of your certificate.

The PKCS#12 file would need to have both halves - hence why it needs the -inkey option.

Improve this answer
2

As Helvick pointed out, PKCS10's response is PKCS7 and it does not contain the private key. So while generating the CSR you should have generated privatekey.key file. You can use the following commands. ( I know this is four years old question but I could not do it while following the discussion on the page ).

openssl pkcs7 -inform DER -in PK7BDownloadedArchive.p7b -text -print_certs -out intermediateCert.pem

openssl pkcs12 -export -in intermediateCert.pem -inkey privateKey.key -out FinalPKCS12Cert.p12

Good luck!

Regards, JE

Improve this answer
1
  • 1
    You may not need the -inform argument.
    – palswim
    Mar 12, 2020 at 19:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.