We have to give our Certificate - managed by one of our suppliers to another one of our supplier. from one we got PFX file, another needs PEM files.

I've ran the conversion using OpenSSL and I've uploaded the files, but they say our chain/bundle part is incorrect.

it looks like this:

Bag Attributes
Microsoft Local Key set: <No Values>
localKeyID: 01 00 00 00 
friendlyName: le-4a0ecc93-da0b-4b35-964a-16469b2508cd
Microsoft CSP Name: Microsoft RSA SChannel Cryptographic Provider
Key Attributes
X509v3 Key Usage: 10 

Bag Attributes
localKeyID: 01 00 00 00 
friendlyName: *.domain.com
subject=/OU=Domain Control Validated/CN=*.domain.com
issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2

And our supplier requesting certificate says it's incomplete.

Would there be difference between the above and three separate .CRT and .KEY files they ask for?

EDIT: Yes, the SP asking for certificate is hosting part of our website, which is not yet encrypted. We need to secure it as some of our customer data is being passed through it. Follow-up question: So is it possible that we were given incomplete pfx file? Command used to extract the data:

openssl pkcs12 -in cert.pfx -out keyStore.pem -nodes


We have to give our Certificate

May we assume you're providing the web hosting provider your SSL key and certificate?

Indeed they will need

  1. key file - content of the PRIVATE KEY (including the -----BEGIN PRIVATE KEY----- and end tag lines)
  2. certificate file - content of the CERTIFICATE (including the tag lines)
  3. Issuer (Go Dady) signing certificate (can be combined in the certificate file from the point 2).

So maybe they are missing the 3rd file.

Would there be difference between the above and three separate .CRT and .KEY files they ask for?

In theory - they could extract the private and public key from the text you've copied and download the issuer's certificate (publicly available). However - seems they let you do your complete homework and provider them all the correct files.

|improve this answer|||||
  • Ensure you are only giving them the key file if you are intended to - ie, if you want them to be able to 'be' you (ie, your web host) – crovers Oct 18 '16 at 14:37
  • From your answer it seems that I'm missing one or more certificates in the file (i've edited the content of the file with exported data by changing the domain name to be certified and removing the content of the KEY and CERTIFICATE parts), correct? – AcePL Oct 19 '16 at 8:57
  • @AcePL - just to be sure - you're providing the SSL certificates to the hosting provider? In that case the provider NEEDS only the ceritficate and the key + certificates provided by the issuer (GoDaddy in your case) – gusto2 Oct 19 '16 at 9:12
  • @Ace: copy/paste (to a new PEM file) the content of the private key, other file - content of the certificate. No other text should be in the pem file (Bag Attributes, ....). You should add a '-chain' parameter to export the whole certificate chain – gusto2 Oct 19 '16 at 9:20
  • 1
    Not to be cheeky, but this bit is actually in the question: chain/bundle is missing. – AcePL Oct 19 '16 at 9:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.