How can I convert a Windows certificate into a PEM format, that includes the chain + root?

Question

I need to import a certificate into a Cisco Ironport for Web SSL inspection. The only input format supported is PEM.

Based on my research the PEM format does support all certificates in the chain, however I'm unsure how to convert a DER/CER/P7b into PEM that includes the chain.

I've been using the following OpenSSL commands to do the conversion, however I don't seem to be getting the full chain. Am I missing a switch?

Extracting the Public key (certificate)

You will need access to a computer running OpenSSL. Copy your PFX file over to this computer and run the following command:

openssl pkcs12 -in <filename.pfx> -clcerts -nokeys -out certificate.cer

This creates the public key file named "certificate.cer" Note: These instructions have been verified using OpenSSL on Linux. Some syntax may vary on the Win32 version.

Extracting and decrypting the Private key

The WSA requires that the private key be unencrypted. Use the following OpenSSL commands:

openssl pkcs12 -in <filename.pfx> -nocerts -out privatekey-encrypted.key

You will be prompted for "Enter Import Password". This is the password created in step 11 above. You will also be prompted for "Enter PEM pass phrase". The is the encryption password (used below).

This will create the encrypted private key file named "privatekey-encrypted.key"

To create a decrypted version of this key, use the following command:

openssl rsa -in privatekey-encrypted.key -out private.key

Answer 1

Specifying openssl pkcs12 -nokeys -clcerts says to NOT output any chain certs. If the chain certs are present in the PKCS12, omit -clcerts to include them in the PEM output. They will be present in the PKCS12 if you create it with Windows Export Wizard and check Include all certificates in the certification path if possible, which is not the default (on my systems at least). This will (normally? always?) include the root, although something impersonating this subject in SSL/TLS -- which I presume is what your Ironport does -- doesn't actually need the root, only the chain below the root. (Technically it might need even less, depending on caching and presence of, support for, and success of AIA, but that gets too complicated.)

Note that PEM-format certs output from pkcs12 -nokeys includes a few lines of info before each ----BEGIN/blob/-----END block. This is a minor extension to PEM implemented by OpenSSL but not everybody else. If the Ironport is actually calling OpenSSL, and many programs that require PEM do so because they are calling OpenSSL, that's okay. If not, and Ironport is doing its own or some other strict PEM implementation, edit the file to delete the comments.

Also, there is no need to create the privatekey encrypted and then decrypt it. It is generally best to encrypt the privatekey, but apparently you need it unencrypted, so you can just use openssl pkcs12 -nocerts -nodes with suitable in and out. Unless whatever instructions you are quoting actually mean but don't say it needs unencrypted "traditional" format (raw PKCS1 rather than PKCS8). For that you must either use OpenSSL 0.9.8* (which is way old, but still supported as of now) where pkcs12 (import) writes the privatekey in traditional format, or with newer OpenSSL let pkcs12 (import) write PKCS8 and then convert to traditional with rsa but even then you can have the PKCS8 and the traditional both unencrypted.

Finally for clarity, P7B contains only certs not privatekey and so is not sufficient to impersonate the subject. The other choices in the Export Wizard are not simply DER and Base-64, which have many other options and uses, but DER or Base-64 (actually PEM) encoding of X.509 cert specifically; those don't contain either the chain or the privatekey and are even more insufficient.