Skip to main content
add warning
Source Link
dave_thompson_085
  • 11.1k
  • 1
  • 31
  • 31

Assuming your filenames are accurate, so client_cert.pem and client_prv_key.pem actually contain the client cert and privatekey respectively in PEM format:

openssl pkcs12 -export -in client_cert.pem -inkey client_prv_key.pem -certfile root_cert.pem -out client.p12
# prompts for the input-key passphrase, then the output passphrase (twice)

# to specify passphrase on commandline for client_prv_key -passin pass:xyz
# similarly passphrase on commandline for the output -passout pass:xyz
# however these make the password(s) visible in ps or similar on most OSes,
# and usually visible in your shell (or CMD) history, which is often insecure

Alternatively you can provide them all on standard input in correct order:

cat client_prv_key.pem client_cert.pem root_cert.pem | openssl pkcs12 -export -out client.p12
# same options for passwordspassphrase

PS- do NOT enter an empty passphrase for the PKCS12. OpenSSL lets you create it even though it's silly, but Java can't decrypt it which defeats your purpose.

Assuming your filenames are accurate, so client_cert.pem and client_prv_key.pem actually contain the client cert and privatekey respectively in PEM format:

openssl pkcs12 -export -in client_cert.pem -inkey client_prv_key.pem -certfile root_cert.pem -out client.p12
# prompts for the input-key passphrase, then the output passphrase (twice)

# to specify passphrase on commandline for client_prv_key -passin pass:xyz
# similarly passphrase on commandline for the output -passout pass:xyz
# however these make the password(s) visible in ps or similar on most OSes,
# and usually visible in your shell (or CMD) history, which is often insecure

Alternatively you can provide them all on standard input in correct order:

cat client_prv_key.pem client_cert.pem root_cert.pem | openssl pkcs12 -export -out client.p12
# same options for passwords

Assuming your filenames are accurate, so client_cert.pem and client_prv_key.pem actually contain the client cert and privatekey respectively in PEM format:

openssl pkcs12 -export -in client_cert.pem -inkey client_prv_key.pem -certfile root_cert.pem -out client.p12
# prompts for the input-key passphrase, then the output passphrase (twice)

# to specify passphrase on commandline for client_prv_key -passin pass:xyz
# similarly passphrase on commandline for the output -passout pass:xyz
# however these make the password(s) visible in ps or similar on most OSes,
# and usually visible in your shell (or CMD) history, which is often insecure

Alternatively you can provide them all on standard input in correct order:

cat client_prv_key.pem client_cert.pem root_cert.pem | openssl pkcs12 -export -out client.p12
# same options for passphrase

PS- do NOT enter an empty passphrase for the PKCS12. OpenSSL lets you create it even though it's silly, but Java can't decrypt it which defeats your purpose.

Source Link
dave_thompson_085
  • 11.1k
  • 1
  • 31
  • 31

Assuming your filenames are accurate, so client_cert.pem and client_prv_key.pem actually contain the client cert and privatekey respectively in PEM format:

openssl pkcs12 -export -in client_cert.pem -inkey client_prv_key.pem -certfile root_cert.pem -out client.p12
# prompts for the input-key passphrase, then the output passphrase (twice)

# to specify passphrase on commandline for client_prv_key -passin pass:xyz
# similarly passphrase on commandline for the output -passout pass:xyz
# however these make the password(s) visible in ps or similar on most OSes,
# and usually visible in your shell (or CMD) history, which is often insecure

Alternatively you can provide them all on standard input in correct order:

cat client_prv_key.pem client_cert.pem root_cert.pem | openssl pkcs12 -export -out client.p12
# same options for passwords