We have to give our Certificate - managed by one of our suppliers to another one of our supplier. from one we got PFX file, another needs PEM files.

I've ran the conversion using OpenSSL and I've uploaded the files, but they say our chain/bundle part is incorrect.

it looks like this:

Bag Attributes
Microsoft Local Key set: <No Values>
localKeyID: 01 00 00 00 
friendlyName: le-4a0ecc93-da0b-4b35-964a-16469b2508cd
Microsoft CSP Name: Microsoft RSA SChannel Cryptographic Provider
Key Attributes
X509v3 Key Usage: 10 

Bag Attributes
localKeyID: 01 00 00 00 
friendlyName: *.domain.com
subject=/OU=Domain Control Validated/CN=*.domain.com
issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2

And our supplier requesting certificate says it's incomplete.

Would there be difference between the above and three separate .CRT and .KEY files they ask for?

EDIT: Yes, the SP asking for certificate is hosting part of our website, which is not yet encrypted. We need to secure it as some of our customer data is being passed through it. Follow-up question: So is it possible that we were given incomplete pfx file? Command used to extract the data:

openssl pkcs12 -in cert.pfx -out keyStore.pem -nodes

1 Answer 1


We have to give our Certificate

May we assume you're providing the web hosting provider your SSL key and certificate?

Indeed they will need

  1. key file - content of the PRIVATE KEY (including the -----BEGIN PRIVATE KEY----- and end tag lines)
  2. certificate file - content of the CERTIFICATE (including the tag lines)
  3. Issuer (Go Dady) signing certificate (can be combined in the certificate file from the point 2).

So maybe they are missing the 3rd file.

Would there be difference between the above and three separate .CRT and .KEY files they ask for?

In theory - they could extract the private and public key from the text you've copied and download the issuer's certificate (publicly available). However - seems they let you do your complete homework and provider them all the correct files.

  • Ensure you are only giving them the key file if you are intended to - ie, if you want them to be able to 'be' you (ie, your web host)
    – crovers
    Oct 18, 2016 at 14:37
  • From your answer it seems that I'm missing one or more certificates in the file (i've edited the content of the file with exported data by changing the domain name to be certified and removing the content of the KEY and CERTIFICATE parts), correct?
    – AcePL
    Oct 19, 2016 at 8:57
  • @AcePL - just to be sure - you're providing the SSL certificates to the hosting provider? In that case the provider NEEDS only the ceritficate and the key + certificates provided by the issuer (GoDaddy in your case)
    – gusto2
    Oct 19, 2016 at 9:12
  • @Ace: copy/paste (to a new PEM file) the content of the private key, other file - content of the certificate. No other text should be in the pem file (Bag Attributes, ....). You should add a '-chain' parameter to export the whole certificate chain
    – gusto2
    Oct 19, 2016 at 9:20
  • 1
    Not to be cheeky, but this bit is actually in the question: chain/bundle is missing.
    – AcePL
    Oct 19, 2016 at 9:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .