How To: Extract a PEM File from a PFX Without the Private Key

Version Affected: All

 

Overview

Some Service Providers and applications require a PEM file instead of a PFX file for services such as SAML signature verification. This article explains how to extract a PEM file from a PFX file without exposing its private key.

Extracting the PEM File

1. Export the certificate and its private key as a PFX file from its current store (for example, via the Windows Certificate Manager MMC snap-in or certutil).
2. Download OpenSSL from https://openssl-library.org/source/. Standalone Windows installers are also available (for example, from https://slproweb.com/products.html), but use third-party installers carefully and at your own risk.
3. Once the PFX has been exported and OpenSSL is installed, open the OpenSSL Command Prompt and browse to the folder containing the exported PFX file.
4. Run the following command, replacing %certificate_name% with the actual name of the certificate:

openssl pkcs12 -in %certificate_name%.pfx -clcerts -nokeys -out %certificate_name%.pem

For example:

openssl pkcs12 -in SecureAuth_Certificate.pfx -clcerts -nokeys -out SecureAuth_Certificate.pem

5. Enter the password used when the PFX was exported, then press Enter. This produces the PEM file.

6. To confirm the PEM file was extracted correctly, open it in a text editor to view its details.

Special Considerations

Do not leave PFX files in unsecured locations. Once a PFX has been imported into a certificate store (recommended, so the private key is exportable if needed again later), delete it from the file system as soon as you no longer need it in that location.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.