Openssl create pfx windows

Собрать SSL-сертификат в PFX-файл (также известный как PKCS#12) можно с помощью OpenSSL в linux и windows системах:

1. Убедитесь, что у вас есть все необходимые файлы:
— сертификат (.crt, .cer, .pem)
— приватный (закрытый) ключ (.key)
— опционально: цепочка промежуточных сертификатов ((.crt, .cer, .pem))

2. Используйте OpenSSL для создания PFX:

openssl pkcs12 -export -out certificate.pfx -inkey private.key -in certificate.crt -certfile fullchain.crt

где:
-out certificate.pfx — выходной PFX-файл;
-inkey private.key — Ваш приватный ключ;
-in certificate.crt — Ваш сертификат;
-certfile ca-bundle.crt — файл с промежуточными сертификатами (опционально, но рекомендуется для корректной работы цепочки доверия).

3. Введите пароль (если требуется):
OpenSSL запросит пароль для защиты PFX-файла. Этот пароль понадобится при импорте сертификата.

Примечание: старые версии Windows могут не поддерживать современные алгоритмы шифрования PFX (например, AES-256). Попробуйте создать PFX с -legacy:

openssl pkcs12 -legacy -export -out certificate.pfx -inkey private.key -in certificate.crt -certfile fullchain.crt

В windows SSL-сертификат в PFX-файл можно собрать с помощью CertUtil –MergePFX:

1. Установка промежуточного сертификата
Промежуточный сертификат импортируем в «Computer\Intermediate Certificate Authorities»

2. Сборка сертификата pfx
Для сборки понадобится ключ и сам сертификат. Файлы должны находиться в одной директории и имена файлов должны совпадать. Используем встроенную утилиту Windows «CertUtil.exe».
Выполняем команду:
CertUtil –MergePFX <имя>.crt <имя>.pfx.

Вводим пароль два раза.

Картинка с сайта: client.cloud4y.ru

На выходе получим .pfx файл.

Для включения в .pfx файл промежуточных сертификатов и сертификата центра сертификации(CA) необходимо экспортировать сертификат с опциями «Yes, export private key» и «Include all certificates in the certification path if possible» в certlm.msc.

Вы уже работаете с сервисами Cloud4Y?

Перейти на вебсайт

Попробовать бесплатно

You have already reported this .

In cryptography, the PKCS#12 or PFX format is a binary format often used to store all elements of the chain of trust, such as the server certificate, any intermediate certificates, and the private key into a single encryptable file. PFX files are usually found with the extensions .pfx and .p12. PFX files are typically used on Windows and macOS machines to import and export certificates and private keys.

Requirements

• The original private key used for the certificate
• A PEM (.pem, .crt, .cer) or PKCS#7/P7B (.p7b, .p7c) File
• OpenSSL (included with Linux/Unix and macOS, and easily installed on Windows with Cygwin)

The commands below demonstrate examples of how to create a .pfx/.p12 file in the command line using OpenSSL:

PEM (.pem, .crt, .cer) to PFX

openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile more.crt

Breaking down the command:

• openssl – the command for executing OpenSSL
• pkcs12 – the file utility for PKCS#12 files in OpenSSL
• -export -out certificate.pfx – export and save the PFX file as certificate.pfx
• -inkey privateKey.key – use the private key file privateKey.key as the private key to combine with the certificate.
• -in certificate.crt – use certificate.crt as the certificate the private key will be combined with.
• -certfile more.crt – This is optional, this is if you have any additional certificates you would like to include in the PFX file.

openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile ca-bundle-client.crt

PKCS#7/P7B (.p7b, .p7c) to PFX

P7B files cannot be used to directly create a PFX file. P7B files must be converted to PEM. Once converted to PEM, follow the above steps to create a PFX file from a PEM file.

openssl pkcs7 -print_certs -in certificate.p7b -out certificate.crt

Breaking down the command:

• openssl – the command for executing OpenSSL
• pkcs7 – the file utility for PKCS#7 files in OpenSSL
• -print_certs -in certificate.p7b – prints out any certificates or CRLs contained in the file.
• -out certificate.crt – output the file as certificate.crt

Video

For more helpful how-tos and the latest cybersecurity news, subscribe to SSL.com’s newsletter here: 

A while back I had a post where I talked about setting up .net core in docker using SSL and a HTTPS port you can read that here

To make a .net core project work on a HTTPS port you need to pass it the cert. One way to do this is to create a PFX cert and load it into the project during the compile. This then means Kestrel will be listening on the HTTPS port for you.

We would configure our .net core app as follows

.UseKestrel(options =>
    options.Listen(IPAddress.Any, 8050, listenOptions =>
    listenOptions.UseHttps("demowebapp.pfx", "XXXX")))

The important part: There are a few ways to do this but this is the way I’m going to cover the way I do it not to say there aren’t other very valid ways of doing it.

Windows subsystem for Linux

In windows 10 they gave us a subsystem of Ubuntu on Windows. If you haven’t tried it check it out here

OpenSSL

I use openSSL inside the subsystem. OpenSSL is a powerful set of tools for creating certs on either linux or windows.

Once I install it

sudo apt-get install openssl

Cloudflare

I use cloudflare for alot of my DNS and caching, etc. One thing it can do is give me origin certificates.

Under the SSL / TLS option

Картинка с сайта: serversncode.com

When you create  a certificate you can set how long it is valid. Because this is my origin and not my edge I can set it to a longer life than a few months. I’ve explained part of this in my Lets talk about HTTPS post.

So once you do that you can generate a PEM Key Format, it will look something like this

Картинка с сайта: serversncode.com

Copy text between the «Begin and End Certificate» including those lines and you can create two files

• mynewcert.pem
• mynewcert.key

In the end these are just text files you need to save onto your computer.

Create PFX Certificate

Now the big bit. In our Linux subsystem we need to mount our drive and find the folder containing our .key and .pem files.

To mount the C: just do the following

cd /mnt/c

You can then move to the folder you saved the .key and .pem file.

Now the bit to generate the .pfx certificate.

openssl pkcs12 -export -inkey mynewcert.key -in mynewcert.pem -name myCert -out mynewcert.pfx

This will generate a .pfx file and save it to the same folder and adds the password when it’s generated.

And that’s it, you have a .pfx file now, you can copy that into the .net core app and set the password.