6

I've been offered some commands to create a .pfx file using OpenSSL. For the most part, my partner gathered this information from: Is it possible to convert an SSL certificate from a .key file to a .pfx?

I have the following files:

  1. 2010certificate.cer
  2. 2010cert_and_key.pem
  3. private_verisign10to11.key

I have tried to generate with both:

openssl pkcs12 -export -out s2010-1.pfx -inkey private_verisign10to11.key -in 2010cert_and_key.pem -certfile 2010certificate.cer
and
openssl pkcs12 -export -out s2010-1.pfx -inkey private_verisign10to11.key -in 2010certificate.cer -certfile 2010cert_and_key.pem

No errors are thrown in this situation, but when I try to view or import the generated file s2010-1.pfx, Protecle says it can't open it. Keytool says: 

keytool -import -file s2010-1.pfx x -keystore cacerts -alias fqdn -storepass <.pfx's pass word>
keytool error: java.lang.Exception: Input not an X.509 certificate

I am assuming the problem is with the .pfx generation, but I don't really know how to test it until the keytool command. Any suggestions on what to do from here would be great.

Community
  • 1
  • 1
Terence
  • 61
  • 1
  • 1
  • 3
  • Java can treat a PKCS12 _as_ a keystore, but [before 8u60 (in 2015 well after this Q)](http://www.oracle.com/technetwork/java/javase/8u60-relnotes-2620227.html) you had to specify it: `keytool -list -keystore whatever.pfx -storetype pkcs12` – dave_thompson_085 Aug 19 '17 at 18:54

2 Answers2

1

Try using TinyCA to open each of your 3 files, because they can be something else that what their extension says, specially the .pem ones. Then use TinyCA to export the keys ; There is a message window displaying both the openssl command and the output of said command.

yPhil
  • 8,049
  • 4
  • 57
  • 83
0

The problem is because keytool -importcert (-import in Java < 1.6) only support importing x509 certificates.

To import a PKCS12 (sometimes delivered in a .pfx file) into a Java .jks file, including cacerts:

keytool -importkeystore -srckeystore my.pfx -srcstoretype PKCS12 -srcstorepass <mysecret> -destkeystore cacerts -deststoretype JKS  -deststorepass changeit
Alastair McCormack
  • 26,573
  • 8
  • 77
  • 100