On my domain name (mydomain.org), I send mails from applications. Some of these applications are on Windows and other on Linux. I use opendkim for Linux and I have also set dns and everything it working just find for Linux. Now I want to send emails from Windows application. The application want a keypair within .pfx file.

How can I generate .pfx from mypkey.private and mykey.txt that was create by opendkim ?


I have found this answer, but this is not helping me that mouch since I have two file that contain public and private key







  • Are you talking about signing mail items (with Outlook/SMIME or similar) or transmitting mail over TLS (either SMTPS or STARTTLS)? For the former you probably need a cert from a 'real' or at least trusted CA; for the latter you can probably use a selfsigned cert. Either way you need some cert to create a PKCS12. – dave_thompson_085 Feb 16 '18 at 2:01
  • I am talking about DKIM signature emailonacid.com/blog/article/email-development/…. Basically it is a system to avoid spoofing mails. Every mail is signed and the receiver can look the dns to very that mails comes from authorized source. – dmx Feb 16 '18 at 7:49

Okay, so DKIM uses only 'raw' publickey crypto and not certificates, but some 'application' for it uses PKCS12 format which requires a certificate. That's pretty silly.

If you have OpenSSL, and on Linux you should, it has several ways to create a self-signed certificate from a private key. A self-signed certificate doesn't accomplish the main purpose certificates were designed for, of distributing trust from a (relatively) centralized source, but it does package a public key with some other data in the form of a certificate, which is often convenient, including here.

The simplest way is req -new -x509 something like:

 openssl req -new -x509 -key privatekey.pem -days N -out dummy.crt 
 # N is the number of days (from now) until the cert expires
 # reliers may or may not care about expiration of selfsigned,
 # but to avoid possible issues it is common to use a longish period 
 # like 5, 10 or 20 years (roughly 1825, 3650 or 7300 days) 

To avoid being prompted for the subject name fields, which are probably meaningless here, you can specify a dummy name something like -subj /CN=mydkim .

It is possible an application silly enough to use PKCS12 for this might want some particular extensions in the certificate; this opens a much broader field because there are about a dozen commonly-used X.509 extensions and hundreds or thousands of more obscure ones. If the 'application' document says anything about cert extensions, or you get an error related to them, post details.

Once you have the cert just use

 openssl pkcs12 -export -in certfile -inkey privatekeyfile -out pkcs12file 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.