Packing OpenSSH certificate to pfx

Question

i want to pack my OpenSSH certificate signed by a CA to a pfx file. From what i saw i need the format of my private key and certificate to be in PEM. I use ssh-keygen to generate the rsa private and public key. The private key is already in PEM format When i create OpenSSH certificate its in OpenSSH format and not in PEM encoding.

I want to use the pkcs12 -export command to generate the pkcs12 package of my private key and my certificate but than it says couldnt load certificates.

I know i need the certificate to be in pem, and I need to give the CA certificate aswell in the -in file But the certificate isnt in PEM and it doesnt recognize it even if i put it forcibly in PEM.

Has anyone ever packed a OpenSSH certificate (not x.509) signed by CA (even though Selfsigned didnt work for me either) and private key to pfx file?

If yes can you give the exact commands from the key generation including the certificate generation and the creation of the pfx file?

Thanks in advance, i have been looking for days without proper answer.

Answer 1

OpenSSH and x509 are not compatible formats. You'll want to create a private key + CSR using openssl instead. After you send the CSR (NOT the key!) to the CA, they will return a signed certificate which you can combine with your private key into a pfx container.

To create a key

openssl genrsa -out 2019-www_server_com.key 2048

To create a certificate signing request

openssl req -new -key 2019-www_server_com.key -out 2019-www_server_com.csr

To create a PFX container from the received certificate and the key

openssl pkcs12 -export -out 2019-www_server_com.pfx -inkey 2019-www_server_com.key -in yourcertificate.crt

Answer 2

In a nutshell, you can use your existing RSA private key (I haven’t tried other types like ECDSA), however, you need to generate a cert with OpenSSL with the proper X.509 extensions in order to pack it into a PFX/PKCS12 file. Here’s what I tried and it worked:

First, generate a CSR, if you want your cert signed by a CA. If not, just skip to the next command to generate a self-signed cert.

openssl req -key .ssh/id_rsa -new -out .ssh/id_rsa.csr

Note: if you use a passphrase for your SSH key, you will be prompted to enter it. The CSR (signing request for your CA) will be output to .ssh. This assumes you want to use .ssh/id_rsa as your private key.

Alternatively, just generate a self-signed cert. Like before, if your SSH key is password-protected, you will be prompted for your SSH key password:

openssl req -key .ssh/id_rsa -new -x509 -days 365 -out .ssh/id_rsa.crt

Note: the above command sets the certificate validity to 1 year (365 days). Adjust as needed. This is largely useless for OpenSSH, since it will ignore the x.509 data, including cert expiration, should you wish to reverse this process.

Now that you have your certificate with proper x.509 metadata (id_rsa.crt) you can pack it along with the private key as usual:

openssl pkcs12 -inkey .ssh/id_rsa -in .ssh/id_rsa.crt -export -out .ssh/id_rsa.pfx

Filename can be either .pfx or .p12, format is the same, AFAIK. Note that this command will ask you for your SSH private key password first, then it will prompt you twice for the PFX/PKCS12 export password.

As mentioned above, to reuse the PFX/PKCS12 file with OpenSSH, you will need to extract and convert the private key from the PFX/PKCS12 archive in PEM format first, then use ssh-keygen to derive the OpenSSH public key from the private key. I’m not sure why you’re doing all this, but hope the above is helpful...

One last thing: I find DigitalOcean’s OpenSSL guide to be quite comprehensive. It doesn’t just give you mindless commands to copy paste, but explains what each command does.