How to validate PFX with public-key privacy/integrity mode

pfxpkcs#12ssl

I have a piece of embedded software generating P12/PFX formatted output data.

The PFX is not password protected, that means instead of using a password-derived encryption/mac key the data is encrypted with a public key and signed with my private key.

In RFC7292 section 3.1 this is called public-key privacy and integrity modes.

My question is, how can I validate the PFX I receive, e.g. using openssl? (I'm not restricted to use openssl, by the way I google'd around but could not find a way…)

I tried

openssl pkcs12 -info -in test.pfx

but openssl requests a password, which is not applicable here. Did I miss any option to not being asked for a password?

Best Answer

openssl pkcs12 -info -in test.pfx -passin pass: -passout pass:

Alternatively, you can just use

openssl pkcs12 -info -in test.pfx

and when it asks for Import Password or PEM Pass Phrase (and you didn't use any while generating the pfx file), just press Enter.

Related Solutions

How to get .pem file from .key and .crt files

Your keys may already be in PEM format, but just named with .crt or .key.

If the file's content begins with -----BEGIN and you can read it in a text editor:

The file uses base64, which is readable in ASCII, not binary format. The certificate is already in PEM format. Just change the extension to .pem.

If the file is in binary:

For the server.crt, you would use

openssl x509 -inform DER -outform PEM -in server.crt -out server.crt.pem

For server.key, use openssl rsa in place of openssl x509.

The server.key is likely your private key, and the .crt file is the returned, signed, x509 certificate.

If this is for a Web server and you cannot specify loading a separate private and public key:

You may need to concatenate the two files. For this use:

cat server.crt server.key > server.includesprivatekey.pem

I would recommend naming files with "includesprivatekey" to help you manage the permissions you keep with this file.

Best Answer

Related Solutions

How to get .pem file from .key and .crt files

Related Topic