Use OpenSSL for Certificate Format Conversion

Source: Internet
Author: User
Tags openssl rsa openssl x509 pkcs12 pkcs7 pfx file

Different certificates are stored in different formats (such as whether the public key or private key is encrypted for storage, a single certificate, or multiple certificates), and are encoded differently (der/base64) different standards (such as PEM/PKCS), so although the X.509 standard specifies the certificate content specification, the certificate files are still varied. Fortunately, OpenSSL has good support for these different standards and can be used to convert certificates of different formats.

In general, there are several tasks for certificate conversion.

Encoding and conversion: Der <--> base64
Conversion of different certificate standards: PKCS series <--> PEM/CER
Private Key addition/subtraction/extraction/Conversion
...

PEM--DER/CER (conversion of BASE64--DER encoding)

OpenSSL X509-outform der-in certificate. pem-out certificate. Der

PEM--P7B (PEM--PKCS #7)

OpenSSL crl2pkcs7-nocrl-certfile certificate. cer-out certificate. p7b-certfile cacert. Cer

PEM--PFX #12)

OpenSSL PKCS12-export-out certificate. pfx-inkey privatekey. Key-in certificate. CRT-certfile cacert. CRT

PEM -- p12 (PEM--PKCS #12)

OpenSSL PKCS12-export-out cert. p12-in CERT. pem-inkey key. pem

CER/DER--PEM (Code DER--BASE64)

OpenSSL X509-inform der-in certificate. cer-out certificate. pem

P7B--PEM (PKCS # 7--pem)

OpenSSL pkcs7-print_certs-in certificate. p7b-out certificate. Cer

P7B--PFX (PKCS # 7--pkcs #12)

OpenSSL pkcs7-print_certs-in certificate. p7b-out certificate. Cer
OpenSSL PKCS12-export-in certificate. cer-inkey privatekey. Key-out certificate. pfx-certfile cacert. Cer

Pfx/P12 -- PEM (PKCS # 12--pem)

OpenSSL PKCS12-in certificate. pfx-out certificate. Cer
If you do not need to encrypt the private key in PEM, you can add option-nodes;
If you do not need to export the private key, you can add the option-nokeys;

PEM BASE64--X.509 text format

OpenSSL X509-in key. pem-text-out cert. pem

Extract the private key (. Key) from the pfx file)

OpenSSL PKCS12-In mycert. pfx-nocerts-nodes-out mycert. Key

PEM--SPC

OpenSSL crl2pkcs7-nocrl-certfile Venus. pem-outform der-Out Venus. SPC

PEM--PVK (supported by OpenSSL 1.x)

OpenSSL RSA-In mycert. pem-outform PVK-strong-out mypvk. PVK

PEM--PVK(For versions earlier than OpenSSL 1.x, you can download the PVK converter and run the following command to complete it)

PVK-in CA. Key-out ca. PVK-nocrypt-topvk

PVK format reference: http://www.drh-consultancy.demon.co.uk/pvk.html

For more options and functions of OpenSSL, see the OpenSSL manual.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.