I have imported a certificate into firefox, and I want to export it into PKCS12 format. The only options that I find are PKCS7 , PEM and DIR. and not PKCS12. I doubt that the certificate has no private key, so is there a way to check that?

EDIT My problem was in the Chrome browser, which I used when I requested the certificate. It seems that it has a problem with storing the private key. I repeated the request with Firefox and things went fine.

  • 1
    Do you want export a certificate or a personal certificate that includes a private key? When I export a personal certificate with key my Firefox automatically selects PKCS#12 format. – Robert Jul 3 '12 at 15:23

You can view Certificate contents in Firefox
(Tools -> Options -> Advanced -> Encryption -> View Certs -> Yours/Authority/etc -> <cert> -> View -> Details -> Certificate Fields -> Public Key)

If you can export to PEM, you can convert that to PKCS12

# export mycert.pem as PKCS#12 file, mycert.pfx
openssl pkcs12 -export \
  -out mycert.pfx -in mycert.pem \
  -name "My Certificate"

Update: Examples of using OpenSSL

Generate a self-signed certificate

  $ openssl req \
  >   -x509 -nodes -days 365 \
  >   -newkey rsa:1024 -keyout mycert.pem -out mycert.pem

View it's contents

  $ openssl x509 -in mycert.pem -noout -text

View the PEM file

  $ cat mycert.pem

Note that whilst a PEM file can contain both private key and a certificate, the private key isn't part of the X.509 certificate.

If the PEM exported by FF lacks the BEGIN and END markers around the Base64 encoded data, OpenSSL can't read the PEM file.

Here's CA certificate I exported from Firefox (*viewed in e.g. notepad)


(ellipsis … where data omitted for brevity)

I can view that OK using openssl x509 -in ff.crt -noout -text (I cut & pasted from Windows to Linux but you can install openssl on Windows too)

  • What if I want to extract the public key and private keys separately from the PEM certificate into two files : usercert.pem and userkey.pem ? – Tarek Jul 3 '12 at 14:05
  • @Tarek You can do that with OpenSSL. See madboa.com/geek/openssl/#cert-pkcs12 and sslshopper.com/article-most-common-openssl-commands.html "You can add -nocerts to only output the private key or add -nokeys to only output the certificates." – RedGrittyBrick Jul 3 '12 at 14:10
  • when I try the command in your answer I get error: unable to load private key 97345:error:0906D06C:PEM routines:PEM_read_bio:no start line:/SourceCache/OpenSSL098/OpenSSL098-35.1/src/crypto/pem/pem_lib.c:648:Expecting: ANY PRIVATE KEY – Tarek Jul 3 '12 at 14:17
  • @Tarek: see updated answer, can you generate and view a self-signed cert using openssl? what's the text content of the PEM file you exported from FireFox? – RedGrittyBrick Jul 3 '12 at 14:48

That is because you do not have the corresponding private key to that certificate.

In cryptography, PKCS #12 is a bundled key format which is commonly used to store the private key with its X.509 certificate together. See more info on Wikipedia here.

You can only export certificates in PKCS #12 format if you have the private key that belongs to it in your browser. This must be on the same computer and the same browser which you used to generate the key signing certificate. See CaCert's Knowledge base article for a clearer explanation:

" Your keys are contained in something called the key "store". You may export public/private keypairs from your store to a file, and optionally (but highly recommended!) secure them with a passphrase. This is typically done by going into the "Manage Certificates" section of your browser (i.e., Firefox), and then performing a "Backup" of your key. This will create a file with with a .P12 or .PFX suffix.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.