i want to pack my OpenSSH certificate signed by a CA to a pfx file. From what i saw i need the format of my private key and certificate to be in PEM. I use ssh-keygen to generate the rsa private and public key. The private key is already in PEM format When i create OpenSSH certificate its in OpenSSH format and not in PEM encoding.

I want to use the pkcs12 -export command to generate the pkcs12 package of my private key and my certificate but than it says couldnt load certificates.

I know i need the certificate to be in pem, and I need to give the CA certificate aswell in the -in file But the certificate isnt in PEM and it doesnt recognize it even if i put it forcibly in PEM.

Has anyone ever packed a OpenSSH certificate (not x.509) signed by CA (even though Selfsigned didnt work for me either) and private key to pfx file?

If yes can you give the exact commands from the key generation including the certificate generation and the creation of the pfx file?

Thanks in advance, i have been looking for days without proper answer.


OpenSSH and x509 are not compatible formats. You'll want to create a private key + CSR using openssl instead. After you send the CSR (NOT the key!) to the CA, they will return a signed certificate which you can combine with your private key into a pfx container.

To create a key

openssl genrsa -out 2019-www_server_com.key 2048

To create a certificate signing request

openssl req -new -key 2019-www_server_com.key -out 2019-www_server_com.csr

To create a PFX container from the received certificate and the key

openssl pkcs12 -export -out 2019-www_server_com.pfx -inkey 2019-www_server_com.key -in yourcertificate.crt
  • Thanks alot for your answer, just 1 thing. Wouldnt the CSR i get from the second command be for x.509? And as such the certificate i get as a result from the csr would be x.509? I need an openssh certificate for the pfx – Ilay Goldman Jan 30 at 13:06
  • That's just me jumping to conclusions. Is [this discussion] (security.stackexchange.com/questions/32768/…) relevant to what you want to achieve? – Mikael H Jan 30 at 15:29
  • It is semi relevant, i need to pack SSH certificate and private key in pkcs12, nothing to do with x.509 . If it is not possible because pkcs12 can only store x.509 certificates or something like that, its an answer for me, not tthe one i hope but an answer. – Ilay Goldman Jan 30 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.