When I import a .p12 into Chrome, it requires a password. Once supplied, it is now stored in Chrome's key store and I never need to import my password again to use it.

How does Chrome manage this? Does it store the password and apply it each use from then on? Or does it extract the certificate and private key, storing them somewhere?


Most programs1 use the PKCS#12 file as only an import/export container.

When you import the file, its contents are processed as individual certificates or private keys, and they're stored in whatever format the program uses. The original PKCS#12 file and its password are then discarded.

Chrome generally uses the OS native storage where available – you can open the Certificate Manager (certmgr.msc) on Windows, Keychain on macOS, and see your certificates there.

On Linux/Unix systems, Chrome uses the NSS database format (same format as Firefox but different location); it can be accessed with certutil -d ~/.pki/nssdb.

1 (Well, Java 10+ also directly uses the same PKCS#12 format for its 'keystore' files, but that's somewhat of an exception and unrelated to Chrome anyway.)

  • The PKCS12 contains a certificate and private key, isn't it bad form to expose a private key? By that, I mean it was previously password protected in the PKCS12, now its "vulnerable". For example, if a PKCS12 is convert to a PEM format for the certificate and key files, does this just put responsibility on the user to secure the files?
    – pstatix
    Aug 3 '20 at 11:36
  • It depends on how the app's storage is protected. For example, Windows cert store is generally encrypted using your OS password, and I believe macOS Keychain is the same. (Linux has nothing built-in, unfortunately, so then it becomes the system owner's responsibility to use e.g. full-disk encryption.) PEM private key files support regular password-based encryption as well.
    – user1686
    Aug 3 '20 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.