I'm exporting a certificate and private key into .pfx file with:

openssl pkcs12 -export -out export.pfx -in public.crt -inkey private.key -nodes

However despite encrypting private key with provided password, OpenSSL also encrypts a public key, which makes it unable to read public key header (like C, O, CN fields) by third party software without providing a password: Example of encrypted public key

How can I export it to pfx without encrypting public key? I want to be able to read public key headers like this: Unencrypted public key


Before migration(!) this was nearly a dupe of https://security.stackexchange.com/questions/195080/how-to-convert-my-cert-chain-to-pfx-without-a-password/

Aside: the body of your question says certificate, which is correct, but your title says public key, which is different and at best highly misleading.

OpenSSL can create a PKCS12 aka PFX with the 'cert bag' unencrypted using the undocumented option value -certpbe NONE:

openssl pkcs12 -export -in cert.pem -inkey key.pem -certpbe NONE -out key.pfx

PS: -nodes is only used in the other direction (importing) to not encrypt the extracted privatekey (if any). For -export it is ignored and the encryption is controlled separately by -keypbe and -certpbe.

  • this might even help against brute force attacks: by default the same password is used for both, but the default algorithm isn't the same: rc2-40 for the cert and 3des for the key (which isn't great to start with): unmitigatedrisk.com/?p=543 . Cracking the rc2-40 might help crack the 3des. – A.B Dec 8 '19 at 14:29
  • 1
    A.B: no, breaking the rc2-40 cert encryption, which is indeed easy, should not help breaking the 3des (or other) key encryption; they use separate salts that should differ with (at least) overwhelming probability, therefore different and unrelated keys (and IVs). And the latter can (but rarely does) use PBES2 which also has a different KDF. – dave_thompson_085 Dec 10 '19 at 5:45
  • ok. For some wrong reason I thought this gave the original password, but it's the key, not the password. – A.B Dec 10 '19 at 6:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.