PEM--DER/CER(BASE64--DER编码的转换)
openssl x509 -outform der -in certificate.pem -out certificate.der
PEM--P7B(PEM--PKCS#7)
openssl crl2pkcs7 -nocrl -certfile certificate.cer -out certificate.p7b -certfile CACert.cer
PEM--PFX(PEM--PKCS#12)
openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt
PEM--p12(PEM--PKCS#12)
openssl pkcs12 -export -out Cert.p12 -in Cert.pem -inkey key.pem
CER/DER--PEM(编码DER--BASE64)
openssl x509 -inform der -in certificate.cer -out certificate.pem
P7B--PEM(PKCS#7--PEM)
openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer
P7B--PFX(PKCS#7--PKCS#12)
openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer
openssl pkcs12 -export -in certificate.cer -inkey privateKey.key -out certificate.pfx -certfile CACert.cer
PFX/p12--PEM(PKCS#12--PEM)
openssl pkcs12 -in certificate.pfx -out certificate.cer
如无需加密pem中私钥，可以添加选项-nodes；
如无需导出私钥，可以添加选项-nokeys;
PEM BASE64--X.509文本格式
openssl x509 -in Key.pem -text -out Cert.pem
PFX文件中提取私钥(.key)
openssl pkcs12 -in mycert.pfx -nocerts -nodes -out mycert.key
提取密钥对（如果pfx证书已加密，会提示输入密码。）
openssl pkcs12 -in 1.pfx -nocerts -nodes -out 1.key
从密钥对提取私钥
openssl rsa -in 1.key -out 1_pri.key
从密钥对提取公钥
openssl rsa -in 1.key -pubout -out 1_pub.key
因为RSA算法使用的是pkcs8模式补足，需要对提取的私钥进一步处理
openssl pkcs8 -in 1_pri.key -out 1_pri.p8 -outform der -nocrypt -topk8
提取私钥详细信息：
openssl rsa -in private_rsa.pem -text -out private.txt
RSA用私钥签名过程示例：
1.签名源数据:
accessType=0&backUrl=null&bizType=000000&certId=70869141586&channelType=07¤cyCode=156&encoding=GBK&merId=898310173990680&orderId=123456780727024&signMethod=01&txnAmt=1&txnSubType=07&txnTime=20170727175202&txnType=01&version=5.1.0
2.对签名源数据做SHA256：
5488ac963dbfecd79a9919a3dbb3984dd08e8c133ecb934582e0584add905928
3.将SHA256的十六进制结果数据转字符编码(BCD2ASC,并且把大写字符转成小写，例如：'A'->41->61('a'))，如下:
0x35, 0x34, 0x38, 0x38, 0x61, 0x63, 0x39, 0x36, 0x33, 0x64, 0x62, 0x66, 0x65, 0x63, 0x64, 0x37, 0x39, 0x61, 0x39, 0x39, 0x31, 0x39, 0x61, 0x33, 0x64, 0x62, 0x62, 0x33, 0x39, 0x38, 0x34, 0x64, 0x64, 0x30, 0x38, 0x65, 0x38, 0x63, 0x31, 0x33, 0x33, 0x65, 0x63, 0x62, 0x39, 0x33, 0x34, 0x35, 0x38, 0x32, 0x65, 0x30, 0x35, 0x38, 0x34, 0x61, 0x64, 0x64, 0x39, 0x30, 0x35, 0x39, 0x32, 0x38,
4.对转换后的数据再次做SHA256运算，结果如下：
8B 51 4D 03 67 27 98 38 D3 40 B3 6E 37 25 73 E4 83 FE DB 5D DE 42 E0 09 9C 9F 80 9A 1B AF 1C 86
5.对4的结果填充后使用私钥签名,填充示例：
00 01 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 30 31 30 0D 06 09 60 86 48 01 65 03 04 02 01 05 00 04 20 8B 51 4D 03 67 27 98 38 D3 40 B3 6E 37 25 73 E4 83 FE DB 5D DE 42 E0 09 9C 9F 80 9A 1B AF 1C 86
6.用私钥签名后做base64编码：
ixNWdVd7eiSRNVnj8BD4RW1t3ZvJHyLHyaL3JF7Pi+CcETqtQVKkIAgXv/mLsCv36hJAkLESJBojZOhEen3bg3SDYT+4A1hKbC90LC9Ts4mkrX3Q6igyOvSu6KGnLELDr6wQA8LaXFunJywGKL5lMG49nV/uhqvKoALR0ZXtZdLqYCu8FQoVFDKVRp57tweVi1s2V53cYpB2zwfYmWkNEyJHkPmf30tSjZaOwpH6ruVWi3AU6Ql/w9jFp2uBSRy1rq4KJlhDMXOmU/iji5tdcLE1qa+2Fjth00hMPjH95ZixyoiWgAJ7OzJwXJMF+f9+VdnmfDTyr68bAgxPnBFokw==
7.将6的签名数据做URL编码:
ixNWdVd7eiSRNVnj8BD4RW1t3ZvJHyLHyaL3JF7Pi%2BCcETqtQVKkIAgXv%2FmLsCv36hJAkLESJBojZOhEen3bg3SDYT%2B4A1hKbC90LC9Ts4mkrX3Q6igyOvSu6KGnLELDr6wQA8LaXFunJywGKL5lMG49nV%2FuhqvKoALR0ZXtZdLqYCu8FQoVFDKVRp57tweVi1s2V53cYpB2zwfYmWkNEyJHkPmf30tSjZaOwpH6ruVWi3AU6Ql%2Fw9jFp2uBSRy1rq4KJlhDMXOmU%2Fiji5tdcLE1qa%2B2Fjth00hMPjH95ZixyoiWgAJ7OzJwXJMF%2Bf9%2BVdnmfDTyr68bAgxPnBFokw%3D%3D