3

I have a certificate that is a PKCS#7 certificate (.spc), and also have a .pem file, how can I convert this to .pfx file on OpenSSL app?

Thanks.

  • Stack Overflow is a site for programming and development questions. This question appears to be off-topic because it is not about programming or development. See [What topics can I ask about here](http://stackoverflow.com/help/on-topic) in the Help Center. Perhaps [Super User](http://superuser.com/) or [Unix & Linux Stack Exchange](http://unix.stackexchange.com/) would be a better place to ask. – jww Feb 08 '18 at 08:38

1 Answers1

2

First, file extensions have no power; they are usually used to indicate the format of the file contents but nothing enforces this. Thus a file named 'something.pem' usually should contain PEM-format data, but it is entirely possible to use that extension for a file that isn't PEM, and to use a different extension for a file that is PEM.

Second, PEM is not a single format, it is a family of dozens of formats, including about one dozen used for private keys.

If you have a .pem file which is actually a private key in one of the PEM formats supported by OpenSSL, and the PKCS7 (.spc) file contains the cert or chain for the public key which matches that private key, and you have or get OpenSSL (since you tagged it I assume you do), then:

 openssl pkcs7 -in whatever.spc -inform der -print_certs \
 | openssl pkcs12 -export -inkey keyfile.pem -out newfile.pfx

If you have a .pem file which is anything other than a PEM-format private key matching the public key in the cert/chain in the PKCS7, you do not have the the data necessary to create a PKCS12/PFX file.

dave_thompson_085
  • 34,712
  • 6
  • 50
  • 70
  • Thanks for the respond, do i need to open OpenSSL using CMD as Administrator?, and do i need to place my spc and pem file in the directoryof openssl? –  Feb 09 '18 at 01:24
  • @NicoTing: OpenSSL doesn't need admin on Windows, or root on Unix, or any special privilege besides accessing the files you specify. It can access files anywhere you specify a path and have permission, although _if_ you make your working dir the OpenSSL install dir (you don't need to if you specify the program path or set your PATH envvar) _you_ may find it convenient to put your files there. However, if you install under \Program Files* or \Windows (which is usually not the default) _don't_ put data files there for _any_ program on modern Windows. – dave_thompson_085 Feb 10 '18 at 02:44
  • I run CMD as admin and type this: cd \ | mkdir certificate | cd certificate | set RANDFILE=c:\certificate\.rnd | set OPENSSL_CONF=c:\OpenSSL-Win32\bin\opennssl.cfg | C:\OpenSSL-Win32\bin\openssl.exe I put my pem and spc file in the certificate folder, but your code doesnt work –  Feb 12 '18 at 01:27
  • @NicoTing: I forgot the CMD part. Using backslash to continue a command works on shells but not on CMD. Either type it without the backslash on one logical line (using wraparound) or use 'hat' `^` instead of backslash. – dave_thompson_085 Feb 12 '18 at 03:45