Questions tagged [pkcs12]
The pkcs12 tag has no usage guidance.
38 questions
1
vote
1
answer
44
views
Does SoapUI accept pfx files as keystores?
I have been trying out Soap UI's WSS options and it isn't quiet clear whether PXF files are accepted as a valid key-store in preference to JKS?
- 13
0
votes
0
answers
138
views
How to create a pkcs12 store where the private key is encrypted with a different password than the store itself?
Basically, as the title says.
Neither keytool nor openssl allow that.
EDIT: apparently, pkcs12 doesn't support that. So, use JKS, which you can easily create with keytool.
- 101
1
vote
0
answers
211
views
how to create truststore and keystore
I created a root CA and intermediate CA, and then created a server CA certificate signed by the intermediate CA. The purpose of whole that is for a TLS one way encryption between a java thin client ...
- 105
0
votes
1
answer
2k
views
How to create PKCS12 container with no password
I have set up 802.1x authentication on my wireless network with EAP-TLS. The use case here is that I would like the presence of a certificate to be both necessary and sufficient for connecting to the ...
- 186
0
votes
0
answers
97
views
Strange keystore from payment processor
I am working on an older software for a company at the moment and in my work have been upgrading a number of libraries. The app connects to a web service hosted by the third party payment processor, ...
- 1,092
2
votes
1
answer
937
views
Private key differs when creating a pfx container and then extracting it from it
Assuming a private_key.pem and the associated certificate client_cert.pem signed by CA (CSR signed with private_key.pem).
Next, I create the pfx container with:
# create pfx with private_key.pem and ...
- 23
1
vote
0
answers
638
views
Specification of AES-based PKCS#5 Password-Based Encryption (PBE)
recently I had a look at the capabilities of the Java keytool to create PKCS#12 containers with a protected private key. According to the standard a private key is protected using a PKCS#8 shrouded ...
- 13
2
votes
1
answer
3k
views
Why do certain openssl-generated pkcs12 MAC algorithms not work?
I have a folder with a private key file, certificate file, and a subfolder with several root certificate files.
I have concatenated the latter into the file $DIR/Root Certificates/all.crt.
If I create ...
- 283
0
votes
1
answer
2k
views
Get a key values mismatch when export cert and key from PKCS#12
I have a PKCS #12 file and want to export certificates and private key from the PKCS #12 file with openssl.
openssl pkcs12 -in test.p12 -nocerts -out key.pem
openssl pkcs12 -in test.p12 -out certs.pem ...
- 103
0
votes
1
answer
3k
views
Can PKCS#12 files contain multiple certificate chains?
I know that PKCS#12 files can contain multiple certificates and private keys.
However, I could not find any resource where any limit was mentioned for the number of certificate chains or private keys ...
4
votes
4
answers
16k
views
Using OpenVPN on Windows instead of VPN apps: missing certificate
Sorry this might be a noob question, but I subscribed to a VPN provider which ships its own app on Windows. Now I thought I'd prefer to use the OpenVPN client app instead.
I create a profile by ...
- 151
2
votes
1
answer
1k
views
Java KeyStore vs OpenSSL implementations of pkcs12 files -They seem to differ. Do they?
I generated a pkcs12 keystore in Java and wanted to inspect it with OpenSSL, but OpenSSL threw back an error. After a bit of head scratching I realized that the KeyStore format in Java allows you to ...
1
vote
2
answers
932
views
PKCS12 password stolen - what's the security impact?
I want to know that what the security impact is if someone leaks the password of a PKCS12 certificate. I am referring to the password which is required when we export the certificate.
1
vote
2
answers
420
views
Can I use PBKDF2 derivation function to generate a MAC in PKCS12 file?
It seems that the default password based key derivation function that is used by PKCS12 to generate a MAC is this one. It is unique to the standard and probably not used anywhere else. Is it possible ...
- 195
1
vote
1
answer
909
views
What are the sources of “SEC_ERROR_REUSED_ISSUER_AND_SERIAL” errors when using self-signed x509 Certificates in PKCS#12 files?
As part of an internal Client/Server application, I have created my own (self-signed) Certificate Authority (CA), as well as both Client and Server certificates signed by my CA.
Loading my CA ...
0
votes
0
answers
196
views
Unable to get information from a PKCS certificate
I sniffed the communication between the client and the server using Wireshark, and I found out that during the handshake session, the client sends its certificate to the server.
I've managed to get ...
- 121
1
vote
0
answers
4k
views
Extracting .p12 cert and key without OpenSSL
I've asked a question on SO, but was directed here since it might align better with this SE.
The problem I have is that I need to extract the certificate and key in unencrypted PEM format for use in ...
- 111
2
votes
1
answer
1k
views
Which format is the PKCS12 successor?
The documentation of a PKCS12 implementation for Go states the following:
It is intended for decoding P12/PFX files for use with the crypto/tls package, and for encoding P12/PFX files for use by ...
- 492
2
votes
3
answers
31k
views
How to convert my cert chain to PFX without a password
I am trying to enable an Azure Front Door instance on the front of my website using my EV cert (Extended Validation Certificate).
However, from Azure Front Door Cert Instructions,
Azure Front Door ...
- 238
0
votes
1
answer
2k
views
Why is PKCS used? [closed]
Can anybody help me in understanding why PKCS is used? My confusion is that whether PKCS is used to transfer key in between client and server OR it is a standard to encrypt and decrypt the payload.
I ...
5
votes
1
answer
33k
views
Extract expiration date from private key file (.p12) without the password
Is it possible to extract the expiration date from a private key (.p12 file) without knowing the password?
I used the command bellow without success:
openssl pkcs12 -in test.p12 -nokeys -nomacver
- 53
1
vote
2
answers
3k
views
Which keystore type is good for java / Tomcat based applications
The application is based on Java and Tomcat server. Which type of keystore is better ? does JKS or PCKS12 ? I understand JDK keytool by default creates JSK type then for which uses-cases one should ...
- 177
3
votes
0
answers
171
views
Custom keystore/certificate to hold asymmetric (RSA) keys
My app will require maintaining an RSA keypair locally on the user's machine. I was a bit disappointed to discover that PKCS#12 and JKS don't offer higher than 3DES (correct me if I have this wrong). ...
- 53
0
votes
1
answer
852
views
How do I upgrade the encryption on my IIS-exported pfx file?
Having found out what encryption algorithm was used to encrypt my pfx file, using openssl, I now want to upgrade the pfx file to use the most secure algorithms available, rather than 40-bit rc2. How ...
- 249
1
vote
1
answer
2k
views
SSL Certificate conversion from PFX to PEM - our SP says files are wrong
We have to give our Certificate - managed by one of our suppliers to another one of our supplier. from one we got PFX file, another needs PEM files.
I've ran the conversion using OpenSSL and I've ...
- 193
5
votes
1
answer
4k
views
How do digital signatures on PDF documents work?
I recently filled out a PDF document which required me to append a digital signature. The PDF document had a link embedded in it that I clicked and went through the process. I am curious how this ...
- 1,576
0
votes
1
answer
269
views
How secure is it to bundle unencrypted private key and a CSR into PKCS12 certificate?
I want to create a self-signed certificate to digitally sign my documents. I want to do so using my existing key pair, but to accomplish this I'd have to export my private key unencrypted into a file, ...
- 161
6
votes
1
answer
4k
views
uploading pkcs12 to yubikey piv slot
i have a id_rsa (private key which is used by me to authentication and encryption together with cert on yubikey piv smardcart provider on slot 9a) now i wish to use this key to create a pkcs12 ...
- 161
2
votes
1
answer
2k
views
What password based key derivation does PKCS #12 use?
I would like to make a note that I have read all of rfc 7292.
I am trying to decrypt encrypted private key in a pkcs#12 pfx file.
The private key is enveloped within pkcs#8 shrouded key bag.
The ...
- 21
1
vote
0
answers
124
views
Theory behind certificate for job account
I made it work a job account protected by a certificate in a java spring application but is not that clear to me the minimal steps.(Could you believe that :) I need some theory.
Here my steps:
...
- 111
10
votes
1
answer
3k
views
Is there an official standard and/or name for PEM certificate bundles?
This is a question that's not really about security proper. It's about security/crypto nomenclature. It's been bugging me a bit, so here goes:
I know two approaches for bundling related certificates/...
- 18.2k
6
votes
1
answer
27k
views
Extract public information from p12 without having the password
I know this question was already asked here but unfortunately there are no satisfactory answers. Please correct me if I'm wrong, but if I have a p12 file the following two situations are possible:
...
- 63
0
votes
1
answer
159
views
Number of certificates in a PKCS#12 archive
Is there command to find the number of certificates in a PKCS#12 archive?
I have the .pfx file sent by a client but need to find out how many certificates it contains. I don't need any of the ...
- 21
2
votes
1
answer
3k
views
P12 private key vs private key file : what is more secure?
The question is a bit tricky because they don't have the same purpose but :
Do both kind of file face the same security issue concerning private key protection : password strength? (PBKDF2 as both ...
- 737
1
vote
2
answers
1k
views
PKCS#12 File - security impacts when imported in Web Browser or Windows Store?
When a PKCS12 file is imported into a Web browser or Windows store the user is prompted for private key password. How does the browser or operating system manage this password? Is it secure?
- 737
2
votes
0
answers
1k
views
Guidance on Login using Digital Signature DSC (PKCS12 and x509 certificate)
I'm interesting in exploring possibility to authenticate user using their Digital Certificate.
The methodology is to first register the DSC from the user and keep their Public key along with Serial ...
- 21
2
votes
1
answer
842
views
Can a PKCS12 file be distributed over insecure channel?
Is the PKCS12 only as secure as the password protecting private keys ? Can I distribute the p12 file over an insecure channel ?
- 737
2
votes
1
answer
3k
views
How secure is PKCS #12
I need to move user cryptographic identity between several user devices. In the operating system I have only one option: use password-protected PKCS #12 to import the identity to the OS secure store.
...
- 205