I believe that the exact procedure below worked for me two weeks ago, but now it doesn't. I start with an RSA private key rsa.pem and generate my own self-signed certificate:

openssl req -new -x509 -key rsa.pem -out rsa.cer

then I try to create a p12 file:

openssl pkcs12 -export -out rsa.p12 -inkey rsa.pem -in rsa.cer

but I only get the following message:

Usage: pkcs12 [options]
where options are
-export       output PKCS12 file
-chain        add certificate chain
-inkey file   private key if not infile
-certfile f   add all certs in f
-CApath arg   - PEM format directory of CA's
-CAfile arg   - PEM format file of CA's
-name "name"  use name as friendly name
-caname "nm"  use nm as CA friendly name (can be used more than once).
-in  infile   input filename
-out outfile  output filename
-noout        don't output anything, just verify.
-nomacver     don't verify MAC.
-nocerts      don't output certificates.
-clcerts      only output client certificates.
-cacerts      only output CA certificates.
-nokeys       don't output private keys.
-info         give info about PKCS#12 structure.
-des          encrypt private keys with DES
-des3         encrypt private keys with triple DES (default)
-seed         encrypt private keys with seed
-aes128, -aes192, -aes256
              encrypt PEM output with cbc aes
-camellia128, -camellia192, -camellia256
              encrypt PEM output with cbc camellia
-nodes        don't encrypt private keys
-noiter       don't use encryption iteration
-nomaciter    don't use MAC iteration
-maciter      use MAC iteration
-nomac        don't generate MAC
-twopass      separate MAC, encryption passwords
-descert      encrypt PKCS#12 certificates with triple DES (default RC2-40)
-certpbe alg  specify certificate PBE algorithm (default RC2-40)
-keypbe alg   specify private key PBE algorithm (default 3DES)
-macalg alg   digest algorithm used in MAC (default SHA1)
-keyex        set MS key exchange type
-keysig       set MS key signature type
-password p   set import/export password source
-passin p     input file pass phrase source
-passout p    output file pass phrase source
-engine e     use engine e, possibly a hardware device.
-rand file:file:...
              load the file (or the files in the directory) into
              the random number generator
-CSP name     Microsoft CSP name
-LMK          Add local machine keyset attribute to private key

I'm just following previous posts:



  • 2
    Check for Unicode hyphens if you copied the command from the browser.
    – techraf
    Aug 31, 2016 at 2:05
  • I would have never guessed that was the issue. Thank you!
    – FullStack
    Aug 31, 2016 at 2:56

1 Answer 1


When get a syntax error (or usage guidance) on a seemingly correct command which you copied from a web browser (not typed yourself), first check the non-alphanumerical characters, like quotes and hyphens.

Browsers nowadays replace them with Unicode characters that might look similar to the human eye, but confuse the shell or programs.

  • Browsers don't replace anything. Blogging/publishing webapps, however, frequently do.
    – user1686
    Aug 31, 2016 at 8:48
  • Thanks, I will consider your input. OS X replaces these characters in the user interface, but I'm not at the console right now to check if it's only for the input or is the display also affected.
    – techraf
    Aug 31, 2016 at 8:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.