As per my understanding, a PKCS12 file supplied by the server needs to be imported into the application as an application if we want to hit the secured endpoints of a server.

PKCS12 file contains the certificates as well as the encrypted private key of the server. This file is then distributed to all the clients who wish to make a secure connection to the server's REST endpoints. Is my understanding wrong? If not, then my question is why does a server need to add a private key in the PKCS12 file? Isn't is potentially a security issue?

Encryption is only done using the public key, no one needs to know about the private key.


A PKCS12 used by a client should contain a privatekey and cert/chain for the client, which is used to authenticate the client so the server knows an SSL/TLS connection is from a legitimate/authorized client and thus requests on this connection should be accepted and/or given appropriate privilege(s). Ideally a client should use a key generated by itself combined with a cert either issued by a CA the server trusts or issued by the server itself, but in some situations an authority like the server admin just provides a key and certs in a PKCS12 so they don't have to spend 20 or 30 hours a day instructing users on how PKI works and how to generate a key and how to generate a key that is not the wrong type or too short or otherwise unacceptable and how to type data into a CSR and what is a CSR and why a CSR isn't a cert and also isn't a key and why their CSR was defective and how they should type the correct data into a CSR so it will actually work and how to look for the key they generated 2 hours ago but have now lost or deleted or overwritten or converted to something else or put on the wrong machine etc etc.

The client keypair(s) should be different from the server keypair, and the server privatekey indeed should never be distributed to a client, or anywhere except a key backup facility or a replacement server. If the server uses either a selfsigned cert or a cert issued by a CA that is not pre-trusted then a cert (not key) serving as a trust anchor for the server, the cert itself if selfsigned and otherwise usually the CA root cert, must be imported as trusted on the client(s).

  • 1
    Your description on what server admins end up doing in real life is so funny yet so true. I was doing some work in this area, and in no time I had so many private keys on my machine that I quickly lost track.
    – Fai Ng
    Jul 23 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.