拆分pkcs12证书常用的操作

拆分pkcs12证书常用的操作

前言

       ThePublic-Key Cryptography Standards (PKCS)是由美国RSA数据安全公司及其合作伙伴制定的一组公钥密码学标准，其中包括证书申请、证书更新、证书作废表发布、扩展证书内容以及数字签名、数字信封的格式等方面的一系列相关协议。

       PKCS#12：描述个人信息交换语法标准。描述了将用户公钥、私钥、证书等其他相关信息打包的语法。

       个人的证书文件后缀为.p12、pfx。

操作

把pkcs12证书以pem的格式输出

openssl pkcs12 -in root.p12 -out key.pem

 

不输出私钥(no private key)

openssl pkcs12 -in root.p12 -outkey.pem  -nokeys

 

 

附录

查看openssl pkcs12命令支持的操作

[root@www ~]# openssl pkcs12 daf

Usage: pkcs12 [options]

where options are

-export       output PKCS12 file

-chain       add certificate chain

-inkey file   private key if not infile

-certfile f   add all certs in f

-CApath arg   - PEM format directory of CA's

-CAfile arg   - PEM format file of CA's

-name "name"  use name as friendly name

-caname "nm"  use nm as CA friendly name (can be used morethan once).

-in infile   input filename

-out outfile  output filename

-noout        don't output anything, just verify.

-nomacver     don't verify MAC.

-nocerts      don't output certificates.

-clcerts      only output client certificates.

-cacerts      only output CA certificates.

-nokeys       don't output private keys.

-info         give info about PKCS#12 structure.

-des          encrypt private keys with DES

-des3         encrypt private keys with triple DES(default)

-idea        encrypt private keys withidea

-seed         encrypt private keys with seed

-aes128, -aes192, -aes256

              encrypt PEM output with cbc aes

-camellia128, -camellia192, -camellia256

              encrypt PEM output with cbccamellia

-nodes       don't encrypt private keys

-noiter       don't use encryption iteration

-nomaciter    don't use MAC iteration

-maciter      use MAC iteration

-nomac        don't generate MAC

-twopass      separate MAC, encryption passwords

-descert      encrypt PKCS#12 certificates with tripleDES (default RC2-40)

-certpbe alg  specify certificate PBE algorithm (defaultRC2-40)

-keypbe alg   specify private key PBE algorithm (default3DES)

-macalg alg   digest algorithm used in MAC (default SHA1)

-keyex        set MS key exchange type

-keysig       set MS key signature type

-password p   set import/export password source

-passin p     input file pass phrase source

-passout p    output file pass phrase source

-engine e     use engine e, possibly a hardware device.

-rand file:file:...

              load the file (or the files inthe directory) into

              the random number generator

-CSP name     Microsoft CSP name

-LMK          Add local machine keyset attribute toprivate key