10

Is it possible to create a pfx file without import password? Or is it possible to remove the import password from pfx file that I've already created?

Improve this question
1

1 Answer 1

Reset to default
12

Is it possible to create a pfx file without import password?

Yes, it is possible: 

openssl req -x509 -newkey rsa:4096 -keyout PrivateKey.pem -out Cert.pem -days 365 -nodes

openssl pkcs12 -export -out keyStore.p12 -inkey PrivateKey.pem -in Cert.pem

Or is it possible to remove the import password from pfx file that I've already created?

Yes, it is possible:

openssl pkcs12 -in old.pfx -nodes | openssl pkcs12 -export -keypbe NONE -certpbe NONE -out new.p12

Conversion from .p12 format to .pfx format is possible by just renaming the file.

Hope that helps!

Improve this answer
4
  • Wow. Good job. That -keypbe NONE -certpbe NONE stuff looks like undocumented behavior. It's neither in openssl.org/docs/manmaster/man1/openssl-pkcs12.html nor in openssl.org/docs/manmaster/man1/openssl-pkcs8.html
    – StackzOfZtuff
    Oct 2, 2019 at 9:04
  • 7
    @StackzOfZtuff What? Undocumented behavior for openssl? Nah... Impossible.
    – dim
    Oct 2, 2019 at 13:12
  • 1
    @dim: yeah. Perish the thought, right? ;)
    – StackzOfZtuff
    Oct 2, 2019 at 13:27
  • The direct pipe only works if old.pfx has the keybag before the certbag; this is not standardized and different file-creators vary. If you do openssl pkcs12 -in old -nodes >temp && openssl pkcs12 -export <temp ... it always works, because temp can be re-read from the beginning; or you can do ( openssl pkcs12 -in old.pfx -nocerts -nodes; openssl pkcs12 -in old.pfx -nokeys ) | openssl pkcs12 -export ... to force the key to be first.
    – dave_thompson_085
    Oct 29, 2022 at 0:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .