503 lines
16 KiB
HTML
503 lines
16 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of PKCS12</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>PKCS12</H1>
|
|
Section: OpenSSL (1SSL)<BR>Updated: 2021-03-22<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
openssl-pkcs12, pkcs12 - PKCS#12 file utility
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
|
|
|
|
<B>openssl</B> <B>pkcs12</B>
|
|
[<B>-help</B>]
|
|
[<B>-export</B>]
|
|
[<B>-chain</B>]
|
|
[<B>-inkey file_or_id</B>]
|
|
[<B>-certfile filename</B>]
|
|
[<B>-name name</B>]
|
|
[<B>-caname name</B>]
|
|
[<B>-in filename</B>]
|
|
[<B>-out filename</B>]
|
|
[<B>-noout</B>]
|
|
[<B>-nomacver</B>]
|
|
[<B>-nocerts</B>]
|
|
[<B>-clcerts</B>]
|
|
[<B>-cacerts</B>]
|
|
[<B>-nokeys</B>]
|
|
[<B>-info</B>]
|
|
[<B>-des | -des3 | -idea | -aes128 | -aes192 | -aes256 | -aria128 | -aria192 | -aria256 | -camellia128 | -camellia192 | -camellia256 | -nodes</B>]
|
|
[<B>-noiter</B>]
|
|
[<B>-maciter | -nomaciter | -nomac</B>]
|
|
[<B>-twopass</B>]
|
|
[<B>-descert</B>]
|
|
[<B>-certpbe cipher</B>]
|
|
[<B>-keypbe cipher</B>]
|
|
[<B>-macalg digest</B>]
|
|
[<B>-keyex</B>]
|
|
[<B>-keysig</B>]
|
|
[<B>-password arg</B>]
|
|
[<B>-passin arg</B>]
|
|
[<B>-passout arg</B>]
|
|
[<B>-rand file...</B>]
|
|
[<B>-writerand file</B>]
|
|
[<B>-CAfile file</B>]
|
|
[<B>-CApath dir</B>]
|
|
[<B>-no-CAfile</B>]
|
|
[<B>-no-CApath</B>]
|
|
[<B>-CSP name</B>]
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
|
|
|
|
The <B>pkcs12</B> command allows PKCS#12 files (sometimes referred to as
|
|
<FONT SIZE="-1">PFX</FONT> files) to be created and parsed. PKCS#12 files are used by several
|
|
programs including Netscape, <FONT SIZE="-1">MSIE</FONT> and <FONT SIZE="-1">MS</FONT> Outlook.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>OPTIONS</H2>
|
|
|
|
|
|
|
|
There are a lot of options the meaning of some depends of whether a PKCS#12 file
|
|
is being created or parsed. By default a PKCS#12 file is parsed. A PKCS#12
|
|
file can be created by using the <B>-export</B> option (see below).
|
|
<A NAME="lbAF"> </A>
|
|
<H2>PARSING OPTIONS</H2>
|
|
|
|
|
|
|
|
<DL COMPACT>
|
|
<DT id="1"><B>-help</B><DD>
|
|
|
|
|
|
Print out a usage message.
|
|
<DT id="2"><B>-in filename</B><DD>
|
|
|
|
|
|
This specifies filename of the PKCS#12 file to be parsed. Standard input is used
|
|
by default.
|
|
<DT id="3"><B>-out filename</B><DD>
|
|
|
|
|
|
The filename to write certificates and private keys to, standard output by
|
|
default. They are all written in <FONT SIZE="-1">PEM</FONT> format.
|
|
<DT id="4"><B>-passin arg</B><DD>
|
|
|
|
|
|
The PKCS#12 file (i.e. input file) password source. For more information about
|
|
the format of <B>arg</B> see the <B></B><FONT SIZE="-1"><B>PASS PHRASE ARGUMENTS</B></FONT><B></B> section in
|
|
<B><A HREF="/cgi-bin/man/man2html?1+openssl">openssl</A></B>(1).
|
|
<DT id="5"><B>-passout arg</B><DD>
|
|
|
|
|
|
Pass phrase source to encrypt any outputted private keys with. For more
|
|
information about the format of <B>arg</B> see the <B></B><FONT SIZE="-1"><B>PASS PHRASE ARGUMENTS</B></FONT><B></B> section
|
|
in <B><A HREF="/cgi-bin/man/man2html?1+openssl">openssl</A></B>(1).
|
|
<DT id="6"><B>-password arg</B><DD>
|
|
|
|
|
|
With -export, -password is equivalent to -passout.
|
|
Otherwise, -password is equivalent to -passin.
|
|
<DT id="7"><B>-noout</B><DD>
|
|
|
|
|
|
This option inhibits output of the keys and certificates to the output file
|
|
version of the PKCS#12 file.
|
|
<DT id="8"><B>-clcerts</B><DD>
|
|
|
|
|
|
Only output client certificates (not <FONT SIZE="-1">CA</FONT> certificates).
|
|
<DT id="9"><B>-cacerts</B><DD>
|
|
|
|
|
|
Only output <FONT SIZE="-1">CA</FONT> certificates (not client certificates).
|
|
<DT id="10"><B>-nocerts</B><DD>
|
|
|
|
|
|
No certificates at all will be output.
|
|
<DT id="11"><B>-nokeys</B><DD>
|
|
|
|
|
|
No private keys will be output.
|
|
<DT id="12"><B>-info</B><DD>
|
|
|
|
|
|
Output additional information about the PKCS#12 file structure, algorithms
|
|
used and iteration counts.
|
|
<DT id="13"><B>-des</B><DD>
|
|
|
|
|
|
Use <FONT SIZE="-1">DES</FONT> to encrypt private keys before outputting.
|
|
<DT id="14"><B>-des3</B><DD>
|
|
|
|
|
|
Use triple <FONT SIZE="-1">DES</FONT> to encrypt private keys before outputting, this is the default.
|
|
<DT id="15"><B>-idea</B><DD>
|
|
|
|
|
|
Use <FONT SIZE="-1">IDEA</FONT> to encrypt private keys before outputting.
|
|
<DT id="16"><B>-aes128</B>, <B>-aes192</B>, <B>-aes256</B><DD>
|
|
|
|
|
|
Use <FONT SIZE="-1">AES</FONT> to encrypt private keys before outputting.
|
|
<DT id="17"><B>-aria128</B>, <B>-aria192</B>, <B>-aria256</B><DD>
|
|
|
|
|
|
Use <FONT SIZE="-1">ARIA</FONT> to encrypt private keys before outputting.
|
|
<DT id="18"><B>-camellia128</B>, <B>-camellia192</B>, <B>-camellia256</B><DD>
|
|
|
|
|
|
Use Camellia to encrypt private keys before outputting.
|
|
<DT id="19"><B>-nodes</B><DD>
|
|
|
|
|
|
Don't encrypt the private keys at all.
|
|
<DT id="20"><B>-nomacver</B><DD>
|
|
|
|
|
|
Don't attempt to verify the integrity <FONT SIZE="-1">MAC</FONT> before reading the file.
|
|
<DT id="21"><B>-twopass</B><DD>
|
|
|
|
|
|
Prompt for separate integrity and encryption passwords: most software
|
|
always assumes these are the same so this option will render such
|
|
PKCS#12 files unreadable. Cannot be used in combination with the options
|
|
-password, -passin (if importing) or -passout (if exporting).
|
|
</DL>
|
|
<A NAME="lbAG"> </A>
|
|
<H2>FILE CREATION OPTIONS</H2>
|
|
|
|
|
|
|
|
<DL COMPACT>
|
|
<DT id="22"><B>-export</B><DD>
|
|
|
|
|
|
This option specifies that a PKCS#12 file will be created rather than
|
|
parsed.
|
|
<DT id="23"><B>-out filename</B><DD>
|
|
|
|
|
|
This specifies filename to write the PKCS#12 file to. Standard output is used
|
|
by default.
|
|
<DT id="24"><B>-in filename</B><DD>
|
|
|
|
|
|
The filename to read certificates and private keys from, standard input by
|
|
default. They must all be in <FONT SIZE="-1">PEM</FONT> format. The order doesn't matter but one
|
|
private key and its corresponding certificate should be present. If additional
|
|
certificates are present they will also be included in the PKCS#12 file.
|
|
<DT id="25"><B>-inkey file_or_id</B><DD>
|
|
|
|
|
|
File to read private key from. If not present then a private key must be present
|
|
in the input file.
|
|
If no engine is used, the argument is taken as a file; if an engine is
|
|
specified, the argument is given to the engine as a key identifier.
|
|
<DT id="26"><B>-name friendlyname</B><DD>
|
|
|
|
|
|
This specifies the ``friendly name'' for the certificate and private key. This
|
|
name is typically displayed in list boxes by software importing the file.
|
|
<DT id="27"><B>-certfile filename</B><DD>
|
|
|
|
|
|
A filename to read additional certificates from.
|
|
<DT id="28"><B>-caname friendlyname</B><DD>
|
|
|
|
|
|
This specifies the ``friendly name'' for other certificates. This option may be
|
|
used multiple times to specify names for all certificates in the order they
|
|
appear. Netscape ignores friendly names on other certificates whereas <FONT SIZE="-1">MSIE</FONT>
|
|
displays them.
|
|
<DT id="29"><B>-pass arg</B>, <B>-passout arg</B><DD>
|
|
|
|
|
|
The PKCS#12 file (i.e. output file) password source. For more information about
|
|
the format of <B>arg</B> see the <B></B><FONT SIZE="-1"><B>PASS PHRASE ARGUMENTS</B></FONT><B></B> section in
|
|
<B><A HREF="/cgi-bin/man/man2html?1+openssl">openssl</A></B>(1).
|
|
<DT id="30"><B>-passin password</B><DD>
|
|
|
|
|
|
Pass phrase source to decrypt any input private keys with. For more information
|
|
about the format of <B>arg</B> see the <B></B><FONT SIZE="-1"><B>PASS PHRASE ARGUMENTS</B></FONT><B></B> section in
|
|
<B><A HREF="/cgi-bin/man/man2html?1+openssl">openssl</A></B>(1).
|
|
<DT id="31"><B>-chain</B><DD>
|
|
|
|
|
|
If this option is present then an attempt is made to include the entire
|
|
certificate chain of the user certificate. The standard <FONT SIZE="-1">CA</FONT> store is used
|
|
for this search. If the search fails it is considered a fatal error.
|
|
<DT id="32"><B>-descert</B><DD>
|
|
|
|
|
|
Encrypt the certificate using triple <FONT SIZE="-1">DES,</FONT> this may render the PKCS#12
|
|
file unreadable by some ``export grade'' software. By default the private
|
|
key is encrypted using triple <FONT SIZE="-1">DES</FONT> and the certificate using 40 bit <FONT SIZE="-1">RC2</FONT>
|
|
unless <FONT SIZE="-1">RC2</FONT> is disabled in which case triple <FONT SIZE="-1">DES</FONT> is used.
|
|
<DT id="33"><B>-keypbe alg</B>, <B>-certpbe alg</B><DD>
|
|
|
|
|
|
These options allow the algorithm used to encrypt the private key and
|
|
certificates to be selected. Any PKCS#5 v1.5 or PKCS#12 <FONT SIZE="-1">PBE</FONT> algorithm name
|
|
can be used (see <B></B><FONT SIZE="-1"><B>NOTES</B></FONT><B></B> section for more information). If a cipher name
|
|
(as output by the <B>list-cipher-algorithms</B> command is specified then it
|
|
is used with PKCS#5 v2.0. For interoperability reasons it is advisable to only
|
|
use PKCS#12 algorithms.
|
|
<DT id="34"><B>-keyex|-keysig</B><DD>
|
|
|
|
|
|
Specifies that the private key is to be used for key exchange or just signing.
|
|
This option is only interpreted by <FONT SIZE="-1">MSIE</FONT> and similar <FONT SIZE="-1">MS</FONT> software. Normally
|
|
``export grade'' software will only allow 512 bit <FONT SIZE="-1">RSA</FONT> keys to be used for
|
|
encryption purposes but arbitrary length keys for signing. The <B>-keysig</B>
|
|
option marks the key for signing only. Signing only keys can be used for
|
|
S/MIME signing, authenticode (ActiveX control signing) and <FONT SIZE="-1">SSL</FONT> client
|
|
authentication, however due to a bug only <FONT SIZE="-1">MSIE 5.0</FONT> and later support
|
|
the use of signing only keys for <FONT SIZE="-1">SSL</FONT> client authentication.
|
|
<DT id="35"><B>-macalg digest</B><DD>
|
|
|
|
|
|
Specify the <FONT SIZE="-1">MAC</FONT> digest algorithm. If not included them <FONT SIZE="-1">SHA1</FONT> will be used.
|
|
<DT id="36"><B>-nomaciter</B>, <B>-noiter</B><DD>
|
|
|
|
|
|
These options affect the iteration counts on the <FONT SIZE="-1">MAC</FONT> and key algorithms.
|
|
Unless you wish to produce files compatible with <FONT SIZE="-1">MSIE 4.0</FONT> you should leave
|
|
these options alone.
|
|
|
|
|
|
<P>
|
|
|
|
|
|
To discourage attacks by using large dictionaries of common passwords the
|
|
algorithm that derives keys from passwords can have an iteration count applied
|
|
to it: this causes a certain part of the algorithm to be repeated and slows it
|
|
down. The <FONT SIZE="-1">MAC</FONT> is used to check the file integrity but since it will normally
|
|
have the same password as the keys and certificates it could also be attacked.
|
|
By default both <FONT SIZE="-1">MAC</FONT> and encryption iteration counts are set to 2048, using
|
|
these options the <FONT SIZE="-1">MAC</FONT> and encryption iteration counts can be set to 1, since
|
|
this reduces the file security you should not use these options unless you
|
|
really have to. Most software supports both <FONT SIZE="-1">MAC</FONT> and key iteration counts.
|
|
<FONT SIZE="-1">MSIE 4.0</FONT> doesn't support <FONT SIZE="-1">MAC</FONT> iteration counts so it needs the <B>-nomaciter</B>
|
|
option.
|
|
<DT id="37"><B>-maciter</B><DD>
|
|
|
|
|
|
This option is included for compatibility with previous versions, it used
|
|
to be needed to use <FONT SIZE="-1">MAC</FONT> iterations counts but they are now used by default.
|
|
<DT id="38"><B>-nomac</B><DD>
|
|
|
|
|
|
Don't attempt to provide the <FONT SIZE="-1">MAC</FONT> integrity.
|
|
<DT id="39"><B>-rand file...</B><DD>
|
|
|
|
|
|
A file or files containing random data used to seed the random number
|
|
generator.
|
|
Multiple files can be specified separated by an OS-dependent character.
|
|
The separator is <B>;</B> for MS-Windows, <B>,</B> for OpenVMS, and <B>:</B> for
|
|
all others.
|
|
<DT id="40">[<B>-writerand file</B>]<DD>
|
|
|
|
|
|
Writes random data to the specified <I>file</I> upon exit.
|
|
This can be used with a subsequent <B>-rand</B> flag.
|
|
<DT id="41"><B>-CAfile file</B><DD>
|
|
|
|
|
|
<FONT SIZE="-1">CA</FONT> storage as a file.
|
|
<DT id="42"><B>-CApath dir</B><DD>
|
|
|
|
|
|
<FONT SIZE="-1">CA</FONT> storage as a directory. This directory must be a standard certificate
|
|
directory: that is a hash of each subject name (using <B>x509 -hash</B>) should be
|
|
linked to each certificate.
|
|
<DT id="43"><B>-no-CAfile</B><DD>
|
|
|
|
|
|
Do not load the trusted <FONT SIZE="-1">CA</FONT> certificates from the default file location.
|
|
<DT id="44"><B>-no-CApath</B><DD>
|
|
|
|
|
|
Do not load the trusted <FONT SIZE="-1">CA</FONT> certificates from the default directory location.
|
|
<DT id="45"><B>-CSP name</B><DD>
|
|
|
|
|
|
Write <B>name</B> as a Microsoft <FONT SIZE="-1">CSP</FONT> name.
|
|
</DL>
|
|
<A NAME="lbAH"> </A>
|
|
<H2>NOTES</H2>
|
|
|
|
|
|
|
|
Although there are a large number of options most of them are very rarely
|
|
used. For PKCS#12 file parsing only <B>-in</B> and <B>-out</B> need to be used
|
|
for PKCS#12 file creation <B>-export</B> and <B>-name</B> are also used.
|
|
<P>
|
|
|
|
If none of the <B>-clcerts</B>, <B>-cacerts</B> or <B>-nocerts</B> options are present
|
|
then all certificates will be output in the order they appear in the input
|
|
PKCS#12 files. There is no guarantee that the first certificate present is
|
|
the one corresponding to the private key. Certain software which requires
|
|
a private key and certificate and assumes the first certificate in the
|
|
file is the one corresponding to the private key: this may not always
|
|
be the case. Using the <B>-clcerts</B> option will solve this problem by only
|
|
outputting the certificate corresponding to the private key. If the <FONT SIZE="-1">CA</FONT>
|
|
certificates are required then they can be output to a separate file using
|
|
the <B>-nokeys -cacerts</B> options to just output <FONT SIZE="-1">CA</FONT> certificates.
|
|
<P>
|
|
|
|
The <B>-keypbe</B> and <B>-certpbe</B> algorithms allow the precise encryption
|
|
algorithms for private keys and certificates to be specified. Normally
|
|
the defaults are fine but occasionally software can't handle triple <FONT SIZE="-1">DES</FONT>
|
|
encrypted private keys, then the option <B>-keypbe </B><FONT SIZE="-1"><B>PBE-SHA1-RC2-40</B></FONT><B></B> can
|
|
be used to reduce the private key encryption to 40 bit <FONT SIZE="-1">RC2. A</FONT> complete
|
|
description of all algorithms is contained in the <B>pkcs8</B> manual page.
|
|
<P>
|
|
|
|
Prior 1.1 release passwords containing non-ASCII characters were encoded
|
|
in non-compliant manner, which limited interoperability, in first hand
|
|
with Windows. But switching to standard-compliant password encoding
|
|
poses problem accessing old data protected with broken encoding. For
|
|
this reason even legacy encodings is attempted when reading the
|
|
data. If you use PKCS#12 files in production application you are advised
|
|
to convert the data, because implemented heuristic approach is not
|
|
MT-safe, its sole goal is to facilitate the data upgrade with this
|
|
utility.
|
|
<A NAME="lbAI"> </A>
|
|
<H2>EXAMPLES</H2>
|
|
|
|
|
|
|
|
Parse a PKCS#12 file and output it to a file:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl pkcs12 -in file.p12 -out file.pem
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Output only client certificates to a file:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl pkcs12 -in file.p12 -clcerts -out file.pem
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Don't encrypt the private key:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl pkcs12 -in file.p12 -out file.pem -nodes
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Print some info about a PKCS#12 file:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl pkcs12 -in file.p12 -info -noout
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Create a PKCS#12 file:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl pkcs12 -export -in file.pem -out file.p12 -name "My Certificate"
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Include some extra certificates:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl pkcs12 -export -in file.pem -out file.p12 -name "My Certificate" \
|
|
-certfile othercerts.pem
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAJ"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?1+pkcs8">pkcs8</A></B>(1)
|
|
<A NAME="lbAK"> </A>
|
|
<H2>COPYRIGHT</H2>
|
|
|
|
|
|
|
|
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
|
|
<P>
|
|
|
|
Licensed under the OpenSSL license (the ``License''). You may not use
|
|
this file except in compliance with the License. You can obtain a copy
|
|
in the file <FONT SIZE="-1">LICENSE</FONT> in the source distribution or at
|
|
<<A HREF="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</A>>.
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="46"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="47"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="48"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="49"><A HREF="#lbAE">OPTIONS</A><DD>
|
|
<DT id="50"><A HREF="#lbAF">PARSING OPTIONS</A><DD>
|
|
<DT id="51"><A HREF="#lbAG">FILE CREATION OPTIONS</A><DD>
|
|
<DT id="52"><A HREF="#lbAH">NOTES</A><DD>
|
|
<DT id="53"><A HREF="#lbAI">EXAMPLES</A><DD>
|
|
<DT id="54"><A HREF="#lbAJ">SEE ALSO</A><DD>
|
|
<DT id="55"><A HREF="#lbAK">COPYRIGHT</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:05:23 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|