I am trying to install a Wildcard SSL Certificate in IIS on Windows Server. It only accepts the .pfx file format for importing & installing an SSL certificate for hosted applications. I got the .csr file from CA as it was a wildcard cert.

I downloaded and installed OpenSSL for Windows (Latest version).

I placed the .crt file & .key file into C:\Program Files\OpenSSL-Win64\bin.

Then I ran this command to generate a random file:

set RANDFILE=C:\Program Files\OpenSSL-Win64\bin\<RANDOMFILENAME>.rnd

Then I ran this command to give a path of config file:

set OPENSSL_CONF=C:\OpenSSL-Win64\bin\openssl.cfg

Finally, I ran this command

openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt

The result of this was:

unable to load private key
140406554043456:error:0909006C:PEM routines:
get_name:no start line:../crypto/pem/pem_lib.c:745:Expecting: ANY PRIVATE KEY

I want to know if I'm making any mistake in the steps that I followed. I also want to know the reason of this error. I have the copy of private key & .crt file

Following are some more inputs which will make my question more specific.

  1. I have the copy of generated-private-key.key file & .crt file. I changed the file names before executing the OpenSSL command. I even created the random file & config file.

  2. The SSL certificate that I got from CA is a wildcard certificate, which I used to install on multiple subdomains of a customer. It was successful. Now while creating the .pfx file once again, I'm facing this problem.

  3. A .pfx file should be created only on the server which was used to create .csr file. In our case, we got the .csr file from CA as it was a wildcard certificate.

(Thanks in advance. Any help is appreciated)

  • Where did you get the .key file? How did you generate it? – Crypt32 Jun 21 at 18:01
  • I got it from certificate authority. – Rajas Jun 22 at 4:41
  • then you need to contact the certification authority for additional help. – Crypt32 Jun 22 at 12:57
  • I tried contacting them but they clearly said that they cannot provide any help. That's why I'm stuck. – Rajas Jun 22 at 13:19
  • I can't tell from here what did they send you. The fact that they refuse to help may suggest you to switch to another CA. Also, if CA sends you private key -- it is very bad CA. Private key is generated by you and you send to CA only CSR with public key inside. Try this command to check the private key: openssl rsa -in privateKey.key -check – Crypt32 Jun 22 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.