Mister PKI

SSL Certificates * SSL Tools * Certificate Decoder

PKCS12 files are commonly used to bundle certificates and private keys together into a single portable file. If you have ever worked with .p12 or .pfx files, you have already encountered the PKCS12 format.

This article is part of the PKI for DevOps Engineers training series. In the previous lesson we explained how to create a CSR with OpenSSL. In this lesson you will learn how PKCS12 files work and why they are commonly used in certificate deployments.

If you want a deeper dive into PKCS12 commands, see our full article on PKCS12 files and OpenSSL.

—

Table of Contents

—

What is PKCS12?

PKCS12 is a cryptographic container format used to store:

  • private keys
  • public certificates
  • certificate chains

It allows these components to be stored together in a single encrypted file protected by a password.

PKCS12 files typically use one of the following extensions:

  • .p12
  • .pfx

These files are commonly used when transferring certificates between systems.

If you want to understand the certificate structure inside these files, see our lesson on X.509 certificates.

—

Why PKCS12 files are used

PKCS12 provides a convenient way to move certificates and keys between systems.

Common scenarios include:

  • importing certificates into web servers
  • installing certificates in Windows servers
  • transferring certificates between applications
  • importing certificates into Java keystores

Because PKCS12 files contain both the certificate and private key, they simplify deployment workflows.

—

Difference between .p12 and .pfx

The .p12 and .pfx file extensions both represent the same PKCS12 format.

Historically:

  • .pfx was used by Microsoft systems
  • .p12 was used in OpenSSL environments

Today, both file extensions typically contain the same PKCS12 structure and are interchangeable.

—

Create a PKCS12 file with OpenSSL

You can bundle a certificate and private key together into a PKCS12 file using the following command:

openssl pkcs12 -export \
-out certificate.p12 \
-inkey private.key \
-in certificate.crt

This command creates a PKCS12 archive containing the private key and certificate.

You will be prompted to create a password that protects the PKCS12 file.

If your certificate includes intermediate certificates, they can also be included using the -certfile option.

openssl pkcs12 -export \
-out certificate.p12 \
-inkey private.key \
-in certificate.crt \
-certfile chain.pem

If you want to understand certificate chains in more detail, see our article on certificate chains.

—

Extract certificates from a PKCS12 file

You can extract certificates from a PKCS12 file using OpenSSL.

For example, to extract the certificate:

openssl pkcs12 -in certificate.p12 -clcerts -nokeys -out certificate.crt

To extract the private key:

openssl pkcs12 -in certificate.p12 -nocerts -out private.key

Once extracted, you can inspect the certificate using openssl x509.

—

Where PKCS12 fits in the TLS workflow

In a typical certificate lifecycle:

  1. Generate private key
  2. Create CSR
  3. Receive certificate from CA
  4. Bundle certificate and key into PKCS12
  5. Import PKCS12 into server or application

This workflow connects with earlier lessons in this training series, including creating CSRs and verifying certificates with OpenSSL verify.

If you need to inspect a certificate chain from a live server, you can also use openssl s_client.

—

Frequently Asked Questions

What is a PKCS12 file?

A PKCS12 file is a secure container that stores certificates and private keys together in a password-protected archive.

What is the difference between PFX and P12?

Both represent the same PKCS12 format. The difference is mainly historical naming conventions.

Why are PKCS12 files password protected?

Because they contain private keys, PKCS12 files are encrypted and protected with a password.

Can PKCS12 files contain certificate chains?

Yes. PKCS12 files can include intermediate and root certificates in addition to the leaf certificate.

—

Next Lesson

In the next lesson you will learn how Java keystores work and how PKCS12 certificates are used in Java applications.

Lesson 7 – Java Keystore Explained →

—

Training Series Navigation