I have a PKCS12 file containing the full certificate chain and private key. I need to break it up into 3 files for an application. The 3 files I need are as follows (in PEM format):

  • an unecrypted key file
  • a client certificate file
  • a CA certificate file (root and all intermediate)

This is a common task I have to perform, so I'm looking for a way to do this without any manual editing of the output.

I tried the following:

openssl pkcs12 -in <filename.pfx> -nocerts -nodes -out <clientcert.key>
openssl pkcs12 -in <filename.pfx> -clcerts -nokeys -out <clientcert.cer>
openssl pkcs12 -in <filename.pfx> -cacerts -nokeys -chain -out <cacerts.cer>

This works fine, however, the output contains bag attributes, which the application doesn't know how to handle.

After some searching I found a suggested solution of passing the results through x509 to strip the bag attributes.

openssl x509 -in <clientcert.cer> -out <clientcert.cer>

This works, but I run into an issue on the cacert file. The output file only contains one of the 3 certs in the chain.

Is there a way to avoid including the bag attributes in the output of the pkcs12 command, or a way to have the x509 command output include all the certificates? Additionally, if running it through x509 is the simplest solution, is there a way to pipe the output from pkcs12 into x509 instead of writing out the file twice?

4 Answers 4


The solution I finally came to was to pipe it through sed.

openssl pkcs12 -in <filename.pfx> -nocerts -nodes | sed -ne '/-BEGIN PRIVATE KEY-/,/-END PRIVATE KEY-/p' > <clientcert.key>
openssl pkcs12 -in <filename.pfx> -clcerts -nokeys | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > <clientcert.cer>
openssl pkcs12 -in <filename.pfx> -cacerts -nokeys -chain | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > <cacerts.cer>
  • 1
    Thanks! This saved me some time today! ;-)
    – Jim P.
    Aug 23, 2019 at 19:58
  • 1
    Thank you SO much!
    – PaulJ
    Nov 26, 2019 at 19:09
  • 1
    For some reason openssl rsa does not print the bag attributes for the keys so the result of the key extraction can be passed through OpenSSL RSA: openssl pkcs12 -in <filename.pfx> -nocerts -nodes | openssl rsa (I left out -out so this will print the results to standard output)
    – karatedog
    Nov 23, 2021 at 16:00

Another solution without sed:

openssl pkcs12 -in <filename.pfx> -nocerts -nodes | openssl pkcs8 -nocrypt -out <clientcert.key>
openssl pkcs12 -in <filename.pfx> -clcerts -nokeys | openssl x509 -out <clientcert.cer>
openssl pkcs12 -in <filename.pfx> -cacerts -nokeys -chain | openssl x509 -out <cacerts.cer>

Singleliner with awk:

openssl pkcs12 -in key.pfx -nodes -out - | awk '/-----BEGIN/{a=1}/-----END/{print;a=0}a'

This discards all output not between PEM begin and end lines. Credit for the AWK goes to https://stackoverflow.com/q/17988756#comment29487454_17988834

  • 3
    That drops the END line making the result not valid PEM; you want '/-BEGIN/{a=1} a; /-END/{a=0}' --or simpler just '/-BEGIN/,/-END/' Mar 22, 2022 at 4:08
  • Much better than the accepted answer
    – mat
    Jul 10, 2023 at 8:47

Just tried using the

openssl pkcs12 -in <filename.pfx> -cacerts -nokeys -chain | openssl x509 -out <cacerts.cer>

to get the chain exported in plain format without the headers for each item in the chain. On this Windows NT server, I got only the first item of the chain exported, not the two items I expected. Instead, I just ended up using

openssl pkcs12 -in <filename.pfx> -cacerts -chain -nokeys -nodes -out <cacerts.cer>

and editing the files with Notepad to remove the unwanted text. Inelegant? Yes, but it got the needed result.

  • 1
    That happened because you piped the result instead of designating an output file. The full chain would have been in the first command's out, but when openssl x509 processed it, it ignored all but the first cert. As for the other bit, obviously editing text manually is effective, but you can't automate that.
    – BryKKan
    Nov 24, 2021 at 17:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .