Exporting a certificate in PKCS12 format from firefox

Question

I have imported a certificate into firefox, and I want to export it into PKCS12 format. The only options that I find are PKCS7 , PEM and DIR. and not PKCS12. I doubt that the certificate has no private key, so is there a way to check that?

EDIT My problem was in the Chrome browser, which I used when I requested the certificate. It seems that it has a problem with storing the private key. I repeated the request with Firefox and things went fine.

Answer 1

You can view Certificate contents in Firefox
(Tools -> Options -> Advanced -> Encryption -> View Certs -> Yours/Authority/etc -> <cert> -> View -> Details -> Certificate Fields -> Public Key)

If you can export to PEM, you can convert that to PKCS12

# export mycert.pem as PKCS#12 file, mycert.pfx
openssl pkcs12 -export \
  -out mycert.pfx -in mycert.pem \
  -name "My Certificate"

---

Update: Examples of using OpenSSL

Generate a self-signed certificate

  $ openssl req \
  >   -x509 -nodes -days 365 \
  >   -newkey rsa:1024 -keyout mycert.pem -out mycert.pem

View it's contents

  $ openssl x509 -in mycert.pem -noout -text

View the PEM file

  $ cat mycert.pem
  -----BEGIN RSA PRIVATE KEY-----
  MIICXAIBAAKBgQDa6JQOLkwoIGhTvcTSYX68Ddaq4hGk/61RSVELaVFJTNQYPB86
  …
  aPj0KoeFJ04/sLcZNZwGcC93rNA66xTICLtGbBXlM1U=
  -----END RSA PRIVATE KEY-----
  -----BEGIN CERTIFICATE-----
  MIICxTCCAi6gAwIBAgIJAOaxxgLFlypwMA0GCSqGSIb3DQEBBQUAMEwxCzAJBgNV
  …
  tz0TMEYxbGIscZbxeJxoK6pe5tOwXtdjStlcITzksdPV5rLp84aeJl4=
  -----END CERTIFICATE-----

Note that whilst a PEM file can contain both private key and a certificate, the private key isn't part of the X.509 certificate.

If the PEM exported by FF lacks the BEGIN and END markers around the Base64 encoded data, OpenSSL can't read the PEM file.

Here's CA certificate I exported from Firefox (*viewed in e.g. notepad)

-----BEGIN CERTIFICATE-----
MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG
…
HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==
-----END CERTIFICATE-----

(ellipsis … where data omitted for brevity)

I can view that OK using openssl x509 -in ff.crt -noout -text (I cut & pasted from Windows to Linux but you can install openssl on Windows too)

Answer 2

That is because you do not have the corresponding private key to that certificate.

In cryptography, PKCS #12 is a bundled key format which is commonly used to store the private key with its X.509 certificate together. See more info on Wikipedia here.

You can only export certificates in PKCS #12 format if you have the private key that belongs to it in your browser. This must be on the same computer and the same browser which you used to generate the key signing certificate. See CaCert's Knowledge base article for a clearer explanation:

" Your keys are contained in something called the key "store". You may export public/private keypairs from your store to a file, and optionally (but highly recommended!) secure them with a passphrase. This is typically done by going into the "Manage Certificates" section of your browser (i.e., Firefox), and then performing a "Backup" of your key. This will create a file with with a .P12 or .PFX suffix.

"

Answer 3

You can list the private keys in your Firefox key store by using the certutil from Mozilla's NSS tools:

certutil -K -d  PATH_TO_YOUR_PROFILE_DIRECTORY

These can be matched aginst the list of certificates from your certificate store:

certutil -L -d  PATH_TO_YOUR_PROFILE_DIRECTORY

Thus you can find out whether you have a corresponding certificate and key by matching the nicknames of the key and cert.

To export a key and cert with a particular NICKNAME (as listed from the above commands) you can use the pk12util:

pk12util -o OutFile.p12 -n "NICKNAME" -d PATH_TO_YOUR_PROFILE_DIRECTORY

Note: If you're using Firefox's Certificate Manager and seeing the error: "Failed to create the PKCS #12 backup file for unknown reasons." this can be down to the fact that Firefox is using the OS's keychain instead of its own one. This can be checked in the Firefox Certificate Manager and looking at the "Security Device" column - if it says "OS Client Cert Token (Modern)“ then this is likely the problem, but if says “Software Security Device” then it is using Firefox's own keychain so it maybe down to another issue.