Assuming your filenames are accurate, so `client_cert.pem` and `client_prv_key.pem` actually contain the client cert and privatekey respectively in PEM format: openssl pkcs12 -export -in client_cert.pem -inkey client_prv_key.pem -certfile root_cert.pem -out client.p12 # prompts for the input-key passphrase, then the output passphrase (twice) # to specify passphrase on commandline for client_prv_key -passin pass:xyz # similarly passphrase on commandline for the output -passout pass:xyz # however these make the password(s) visible in ps or similar on most OSes, # and usually visible in your shell (or CMD) history, which is often insecure Alternatively you can provide them all on standard input *in correct order*: cat client_prv_key.pem client_cert.pem root_cert.pem | openssl pkcs12 -export -out client.p12 # same options for passwords