CODEWITHSUNDEEP
opensslpkcs#12
Greg
Greg

Reputation: 10788

How can I create a .p12 or .pfx file without a private key?

I'm trying to create a .p12 file that does not contain a valid identity (public key / private key pair) in order to test my app's certificate import functionality. Is it possible to do this with the openssl tool?

I've tried

openssl pkcs12 -in client-certonly.pem -export -out client-certonly.p12

but I get an error:

unable to load private key
471:error:0906D06C:PEM routines:PEM_read_bio:no start line:/SourceCache/OpenSSL098/OpenSSL098-50/src/crypto/pem/pem_lib.c:648:Expecting: ANY PRIVATE KEY

If it isn't possible to do this with openssl, is there another tool I can use?

Upvotes: 57

Views: 143656

Answers (2)

Ramunas
Ramunas

Reputation: 1175

For anyone who has problem and get error message "unable to load certificates", try this approach:

openssl.exe x509 -inform der -in "C:\Temp\myfile.cer" -out "c:\Temp\myfile.pem"

openssl.exe pkcs12 -export -out "c:\Temp\myfile.pfx" -nokeys -in "c:\Temp\myfile.pem"

Upvotes: 4

jariq
jariq

Reputation: 12108

There is a very handy GUI tool written in java called portecle which you can use for creation of an empty PKCS#12 keystore and also for an import of the certificate without the private key into the PKCS#12 keystore - this functionality is available under "Import trusted certificate (Ctrl-T)" button.

However if you insist on using OpenSSL you can use this command:

openssl pkcs12 -export -nokeys -in certificate.cer -out pkcs12.pfx

Upvotes: 98

Related Questions