1

I've currently encountered a unique issue. To help understand the predicament I'll provide some background. Our company hired a third-party to develop an application, apart of this web application package was the purchase of an SSL Certificate.

After they purchased the SSL they exported it into a Personal Information Exchange (.pfx).

The issue now occurs here...

Our company web-server utilizes the Plesk Panel 11. Which complicates matters for two reasons.

  1. The first is that if I directly install the certificate Plesk will not recgonize the certificate and will eventually overwrite the contents in our Microsoft Certificate Store within the Windows Server MMC Certificate Snap-In.

  2. The second issue is sheer bad luck, Plesk doesn't recognize the .pfx extension. It apparently only understands the following:

    • Private Key (.key)

    • Certificate (.crt)

    • CA Certificate (-ca.crt)

So my original thought was to simply convert the file into a valid format, which resulted in an error. The second attempt was to follow a command line control to export the file format to the valid extension. The results are still disappointing:

                Error: Invalid Certificate Format

Since the file installed was a .pfx it does not allow me to convert it to anything else. Unfortunately when utilizing Open SSL it only converted to a .pem. Which to my dismay is also unsupported-

Any assistance would be terrific.

Update:

I attempted to follow this question on Stack Overflow. Unfortunately Windows Server 2012 doesn't appear to do the conversion as well. It does convert it into a valid format, but then the Private Key can't be found.

Community
  • 1
  • 1
Greg
  • 11,302
  • 2
  • 48
  • 79

1 Answers1

1

In order to solve this issue I followed this blog here.

So I attempted to utilize Open SSL again, with these steps:

// Extract Private Key
openssl pkcs12 -in [yourfile.pfx] -nocerts -out [keyfile-encrypted.key]


// Extract Certificate
openssl pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out [certificate.crt]


// Encrypted Private Key
openssl rsa -in [keyfile-encrypted.key] -out [keyfile-decrypted.key]

Again you need to enter an import password. This time you need to enter the new password that you created in step 1. After that you’re done. You decrypted your private key. In the folder you ran OpenSSL from you’ll find the certifcate (.crt) and the two private keys (encrypted and unencrypted).

That is how I solved my question.

Community
  • 1
  • 1
Greg
  • 11,302
  • 2
  • 48
  • 79