Need help in creating a .PFX file for SSL Certificate Installation

Question

I am trying to install an SSL Certificate in IIS on Windows Server. It only accepts the .pfx file format for importing & installing an SSL certificate for hosted applications.

1. I downloaded and installed OpenSSL for Windows from here.
2. I placed the .crt file & .key file into C:\Program Files\OpenSSL-Win64\bin.

3. Then I ran this command to generate a random file:

   set RANDFILE=C:\Program Files\OpenSSL-Win64\bin\<RANDOMFILENAME>.rnd
   

4. Then I ran this command to give a path of config file:

   set OPENSSL_CONF=C:\OpenSSL-Win64\bin\openssl.cfg
   

5. Finally, I ran this command

   openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt
   

The result of this was:

unable to load private key
140406554043456:error:0909006C:PEM routines:
get_name:no start line:../crypto/pem/pem_lib.c:745:Expecting: ANY PRIVATE KEY

I want to know if I'm making any mistake in the steps that I followed. I also want to know the reason of this error.

Answer 1

Let me explain what all of these files are and what they mean. Then the solution will become more obvious:

What is a public and private key?

Public and private keys are two parts of a key, used for asymmetric encryption. They are mathematically related, and are generated together. The public key, as the name suggests, can be made public without any loss of security. In fact, it's necessary so others can send messages.

When sending a message, the sender uses the recipients public key to encrypt a message. The recipient then uses their corresponding private key to decrypt the message.

While there are no standardized extensions for public and private key files, commonly chosen names are myname.pub.pem and myname.priv.pem. Some people use myname.pub.key and myname.key (or myname.priv.key), but on Linux systems, extensions are not important.

What is a certificate?

A certificate is a public key, which was signed by another certificate. The way this works is that someone creates a certificate signing request, which contains their public key and is signed by their private key. The request also contains other identification information, such as domain name, e-mail address, etc., depending on the intended purpose of the certificate. The request is then sent to a certificate authority, which validates this information somehow and then signs the request (or not).

The result of this signature is a certificate, which is basically this:

Hello, my name is Alice and my public key is

11:22:33:44:55:66:77:88
99:00:AA:BB:CC:DD:EE:FF

Bob has signed that I am Alice. Bob's certificate is below:

---

Hello, my name is Bob and my public key is

AB:CD:EF:01:02:03:04:05
06:07:08:09:10:12:13:14

Claus has signed that I am Bob. Claus' certificate is below:

...

This would keep going until someone eventually signs their own certificate. This means they claim to be who they are, and you should just trust them. These certificates are called "root certificates" and are shipped together with your operating system.

Since a certificate is, in it's most basic sense, a public key with "stuff added to it", you still need the corresponding private key to use it. You can download certificates from other websites too, but without the corresponding private key, you cannot use them in any way.

What is a PKCS #12 file?

In the broadest terms, a PKCS #12 file is a bundle of cryptographic things. As stated above, in order to use a certificate, you need the corresponding private key. To make things "simple" for deployment, the certificate and the private key are often bundled together in one PKCS #12 file (e.g. myname.pfx).

Of course, PKCS #12 offers much more, and Wikipedia gives a good overview over its features.

So, what is the problem?

The problem is in the following line:

openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt

What this does is take a certificate (certificate.crt) and a private key (privateKey.key) and bundles them into one PKCS #12 file (certificate.pfx).

The error "unable to load private key" and "Expecting: ANY PRIVATE KEY" indicate that what you provided is no private key. What exactly the reason for this is can't be deducted from the information you provided, but here are some wild guesses:

• You didn't see that privateKey.key was a placeholder and your file is named differently.
• You didn't change into the correct working directory where the certificate and private key were.
• You used your public key instead of your private key.
• You don't have correct permissions for your private key.
• Your private key is not in a recognized format (e.g. newline shenanigans)

I hope this explains the situation well enough and gives you enough pointers to go by to find a solution.

Answer 2

I was also stuck on same.

OpenSSL command did not worked as expected for this.
openssl pkcs12 -export -in c.cer -inkey c.key -out d.pfx

So I ended up using Certutil on Windows. As we wanted to add it to Azure.

Note:-
1. Make sure to change .crt to .cer.
2. Make sure to put the .cer and .key files into the same folder and with same name - (c.cer and c.key)

Then run:
certutil -MergePFX c.cer c.pfx

You should get your combined pfx file.
Cheers!