I'm trying to convert a pfx to cer and key format to use them with Nginx.

I'm using the following commands:

openssl pkcs12 -in input.pfx -out mycerts.cer -nokeys -clcerts


openssl pkcs12 -in input.pfx -out mycerts.key -nocerts -nodes

The problem is that the cer and key files don't match!

openssl x509 -modulus -noout -in mycerts.crt | openssl md5


openssl rsa -modulus -noout -in mycerts.key | openssl md5

With other pix files the procedure works as expected. How can I get a valid set of certificates for usage with nginx?


When I generate a new pfx file and run the same commands I get a valid output to your test.

Steps I took to reproduce:

# generate new x509 key/cert pair
openssl req -x509 -newkey rsa:4096 -keyout cert.key -out cert.pem -days 365

# validate key and cert
openssl rsa-modulus -noout -in cert.key | openssl md5
openssl x509 -modulus -noout -in cert.pem | openssl md5

# export key/cert pair to pkcs12
openssl pkcs12 -export -out cert.pfx -in cert.pem -inkey cert.key

# extract key and cert from pkcs12 file
openssl pkcs12 -in cert.pfx -out export.crt -nokeys -clcerts
openssl pkcs12 -in cert.pfx -out export.key -nocerts -nodes

# validate exported key and cert
openssl rsa -modulus -noout -in export.key | openssl md5
openssl x509 -modulus -noout -in export.pem | openssl md5

So your PKCS12 input file must be constructed erroneously. Please check with your source if the PKCS12 file is faulty, or if you generated yourself if the file was properly generated.

PKCS12 can be a complex structure of keys, certificates and intermediate certificate. I don't think the file structure prohibits storing a certificate and a key that do not match, although OpenSSL does prohibit it on export:

$ openssl pkcs12 -export -out cert.pfx -in cert.pem -inkey other.key
No certificate matches private key
  • Isn't the validation file should be export.crt instead of export.pem ?
    – karthik101
    Sep 15 '19 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.