2

I am trying to enable an Azure Front Door instance on the front of my website using my EV cert (Extended Validation Certificate).

However, from Azure Front Door Cert Instructions,

Azure Front Door Service currently only supports certificates uploaded with a PFX without a password.

I have this cert chain in .cer format and .pfx format with a password, how do I convert it in to the necessary format?

Improve this question

3 Answers 3

Reset to default
4

Combining two of the answers above, to create a PFX without a password for Azure Front Door from an existing PFX with a password, I did:

          openssl pkcs12 -in input.pfx 
               -nodes | openssl pkcs12 
               -export -keypbe NONE 
               -certpbe NONE 
               -out output.pfx
Improve this answer
3

I was able to run this command using openssl and get a PFX cert file without a password as required by FrontDoor:

openssl pkcs12 -export -keypbe NONE -certpbe NONE -in cert.crt -inkey cert.key -out out.pfx

Then press enter on the password prompt twice.

Improve this answer
2

I'm not sure what Azure means by 'without a password'. OpenSSL can create a PKCS12 with the contents unencrypted, but it still has a PBMAC which uses a password -- but which a reader that violates the standard can ignore.I don't know how I missed it, but since 1.0.0 -nomac DOES avoid the PBMAC. To suppress both encryption and MAC, if you have the separate key and cert both in PEM:

 openssl pkcs12 -export -keypbe NONE -certpbe NONE -nomac -in cert.pem -inkey key.pem -out out.p12 
 # if you need to add chain cert(s), see the man page or ask further

otherwise since you have an existing pfx this MAY work:

 openssl pkcs12 -in old.pfx -nodes | openssl pkcs12 -export -keypbe NONE -certpbe NONE -nomac -out new.p12

(ADD) but that depends on the bag order used by the software that created old.pfx which can vary; if it says 'unable to load certificates' or 'could not read any certificates' you need instead:

 (openssl pkcs12 -in old.pfx -nodes -nocerts; openssl pkcs12 -in old.pfx -nokeys) | \
      openssl pkcs12 -export -keypbe NONE -certpbe NONE -nomac -out new.p12
 # or possibly
 openssl pkcs12 -in old.pfx -nodes >temp; openssl pkcs12 -export <temp -keypbe NONE -certpbe NONE -nomac -out new.p12

But my previous answer without -nomac apparently worked for at least some people because the reader can ignore a MAC that it can't verify without the password, but can't use the encrypted bags without the password.

Improve this answer
4
  • When you say "if you have the separate key and cert both in PEM" What does that mean? As I said I have .cer format and .pfx format with a password? I think that .cer is a version of PEM, so I'll try that, but is the entire chain (from the .cer) file included?
    – Aaron
    Oct 19, 2018 at 13:56
  • So Dave I don't have a separate key file, only the one .cer file, and then also I exported a .pfx file from digicert that includes a password.
    – Aaron
    Oct 19, 2018 at 19:30
  • I re-exported the key to separate .crt and .key files, then ran a slightly mofiied version of your command that was able to do it: openssl pkcs12 -export -keypbe NONE -certpbe NONE -in cert.crt -inkey cert.key -out out.pfx
    – Aaron
    Oct 19, 2018 at 19:38
  • .cer is generally used for both DER and PEM (especially in MS), but only the latter works for this command, while .key is used for many formats, only a few of them PEM and workable here, which I wanted to emphasize. You can use whatever extensions you want for your own files, at the risk of misleading other people. PFX and PKCS12 or P12 are the same thing and don't need to be distinguished. More substantively, a PFX/P12 is normally encrypted and later decrypted with a password (sometimes more than one), but it does not contain the password(s); that would be completely insecure.
    – dave_thompson_085
    Oct 22, 2018 at 9:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .