1

I have a p12 storage of certificates, and there are a lot of certificates, they are related to a few different sites, so there are a lot of certs for one site. Im trying to extract them all in a way, that will preserve their names, because there is an important information on the name, identifying cert user by private data. But so far i tried this:

pkcs12 -in myDatabaseCerts.p12 -clcerts -nokeys -out publictheCerts.pem

This way i can get all certificates into one file.

And

openssl pkcs12 -in myDatabaseCerts.p12 -nocerts -out keys.pem

Is there a way i can extract all this data into individual file of crt and key and preserve their names automatically? So i would get the list in the end like:

John_Williams_ID_18321239.crt and John_Williams_ID_18321239.privatekey(or .pem)

I want to split the p12 into files like this because later i need to assemble each pair into individual p12 file, so basically convert the whole p12 storage, into many many individual files which contains only one key : certificate pair. Is there a way you can do this with openssl? Or only way would be to generate to separate files with key and certificate and parse them using some written script?

Improve this question

1 Answer 1

Reset to default
2

Much as you speculated, you can easily parse the output of openssl pkcs12 to split apart the pieces if and only if the identifier you want is the friendlyname and/or localkeyid, because those are the only two pieces of metadata usually provided. For example for the private keys using only friendlyName because it's easier and should usually be enough:

openssl pkcs12 -in combined -nocerts | awk '/friendlyName:/{n=$2} \ /^-----BEGIN.*PRIVATE/,/^-----END.*PRIVATE/{print >n".key"}'

This requires you to type the password of the input p12, and type twice a password for each output key; to avoid this you can add -passin and -passout options as per the man page (assuming it's okay for all output keys to use the same password). Or if it's okay to have the privatekeys NOT encrypted, add -nodes -- if you promptly put these back into new (and encrypted) p12 files and securely erase (e.g. shred) the unencrypted files that should be safe; otherwise you need to be very careful no unauthorized person can look at or get a copy of the unencrypted privatekeys.

The same thing can be done for the certificates, but you may not need to. If the only thing you want is to create individual p12 files as you described, and your privatekeys are all different, you can just do for each privatekey

cat $one.key allcerts | openssl pkcs12 -export (other options) >$one.p12

and it will put in each output p12 only the one cert from the input allcerts that matches the key.

Alternatively, instead of the pre-written openssl commandline, you can write a program using openssl library that does anything you like: poke around inside each of the bags and subbags (after decryption), pull out whatever data you like, modify it (perhaps translate special characters etc), and so on. That's a significantly bigger job, though.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.