Convert .p10 file to a cert.pem and key.pem file

Question

I have a .p10 file and a password, however, I haven't been able to find what I need to do to convert this into a certificate and an RSA private key file, which needs to also include the bag attributes (localkeyid and friendlyname) and the key attributes as well as issuer and subject in the certificate.

I'm on OS X an I do have openSSL installed (if needed I can also use Ubuntu or Windows though), and was able to view the attributes and issuer/subject using openssl req -noout -text -in file.p10 but I'm not sure where to go from here.

I need these files for pybankid.

Answer 1

You need to complete a few more steps in order to get what you need.

Let me explain the complete process to create a certificate:

1. Generate a key (with or without a pass phrase).

2. Create a Certificate Signing Request (CSR) using your key.

3. Send your CSR to the Certificate Authority (CA) (in your case the partnering bank) and ask them to sign it.

4. Once you get the certificate from the CA, convert it to the desired format using you key.

The .p10 file you have is most likely a CSR. To verify, try:

openssl req -noout -text -in *.p10

and look for something like:

Certificate Request:
Data:
    Version: 0 (0x0)...

You have a pass phrase, but it's not clear to me if you have access to the key used to generate the CSR, make sure you do before you send your request to the CA (step 3). Otherwise you will not be able to use the singed certificate.

Once you have a signed certificate (something like cert.crt), you can see the details using this command:

openssl x509 -text -in cert.crt -noout

Now you are ready for the final step (4).

To generate a .pfx/.p12 file, use:

openssl pkcs12 -inkey *.key -in *.crt -export -out certificate.pfx

to then convert certificate.pfx to .pem (including bag attributes), use:

openssl pkcs12 -in *.pfx -out cert.pem -nodes