How To: Extract a PEM File from a PFX Without the Private Key – SecureAuth Support

Version Affected: All

Overview

Some Service Providers and applications require a PEM file instead of a PFX file for services such as SAML signature verification. This article explains how to extract a PEM file from a PFX file without exposing its private key.

Extracting the PEM File

Export the certificate and its private key as a PFX file from its current store (for example, via the Windows Certificate Manager MMC snap-in or certutil).
Download OpenSSL from https://openssl-library.org/source/. Standalone Windows installers are also available (for example, from https://slproweb.com/products.html), but use third-party installers carefully and at your own risk.
Once the PFX has been exported and OpenSSL is installed, open the OpenSSL Command Prompt and browse to the folder containing the exported PFX file.
Run the following command, replacing %certificate_name% with the actual name of the certificate:

openssl pkcs12 -in %certificate_name%.pfx -clcerts -nokeys -out %certificate_name%.pem

For example:

openssl pkcs12 -in SecureAuth_Certificate.pfx -clcerts -nokeys -out SecureAuth_Certificate.pem

Enter the password used when the PFX was exported, then press Enter. This produces the PEM file.

OpenSSL command prompt running the pkcs12 command against SecureAuth_Certificate.pfx and prompting for the Import Password, with the resulting SecureAuth_Certificate.pem file shown alongside the original .pfx file in File Explorer.

To confirm the PEM file was extracted correctly, open it in a text editor to view its details.

SecureAuth_Certificate.pem opened in a text editor, showing Bag Attributes, a friendlyName, the certificate subject and issuer lines (issuer showing O=SecureAuth Corporation), and the BEGIN CERTIFICATE block.

Special Considerations

Do not leave PFX files in unsecured locations. Once a PFX has been imported into a certificate store (recommended, so the private key is exportable if needed again later), delete it from the file system as soon as you no longer need it in that location.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.