As the title says:

Using OpenSSL, how do I generate a self-signed certificate in DER format which includes the private key? Is this possible at all?

I have found a myriad of posts which explain how to join a certificate and the corresponding private key into a file in PFX format, but this is not what I'm after.


Actually, I need to import that certificate into the Windows certificate store. But I'd still like to generate the certificate / key using Linux / OpenSSL.

I first tried to generate the certificate in PEM format and just appended the private key file (also in PEM format) to it. Windows certificate management could import that file, but lost the private key (it correctly shows the certificate, but claims that I don't have a private key for it).

Next I took the certificate and the private key and joined them into a PFX file. The problem with that is that OpenSSL is not able to generate a PFX file without an export password for the private key. Windows certificate management can import that PFX file (including the private key), but the service which should use the certificate refuses using it with obscure error messages. I have put two days into debugging, but to no avail. Perhaps the export password is the problem (although the Windows certificate subsystem hopefully doesn't ask for it once the certificate has been imported).

So my last hope is to generate a DER file containing the certificate along with the private key. I know that it is possible to put a certificate and a private key into a DER file because I can create such files using Windows tools. But how do I do that under Linux / OpenSSL?

I am using something like the following script to generate the same certificate in various formats (this is the current version, already tried countless variations):


# Generate RSA key
openssl genrsa -out key.pem 4096

# Generate certificate request
openssl req -new -nodes -key key.pem -out csr.pem -subj /CN=DAX

# Generate self-signed certificate (sign the certificate request)
openssl req -x509 -nodes -sha256 -days 36500 -key key.pem -in csr.pem -out cert.pem

# Add some extensions ...
openssl x509 -extfile /etc/ssl/pp-openssl.cnf -sha256 -days 36500 -signkey key.pem -in cert.pem -out ext.pem

# Append private key to the PEM certificate
cat key.pem >> ext.pem

# Create PFX and DER formats
openssl pkcs12 -nodes -export -out cert.pfx -inkey key.pem -in ext.pem
openssl x509 -outform der -out cert.cer -in ext.pem

The last line obviously strips the private key (does not include it into the DER file), although it is included in the PEM input file.


I know that it is possible to put a certificate and a private key into a DER file because I can create such files using Windows tools.

It turned out that this statement which I have made above is wrong. I have misinterpreted my test results - see my comments below. In short, it is not possible to have a certificate and a private key in the same DER file.

However, I am leaving the original question as-is for future reference.

  • 2
    DER is an "encoding" format, like PEM. It handles a single "stuff", either a key or a certificate. Instead PFX or truly PKCS12 is a container format, that is a structure which can store multiple things. "I know that it is possible to put a certificate and a private key into a DER file because I can create such files using Windows tools." can you show an example of this? – Patrick Mevzek Oct 2 '19 at 0:10
  • @PatrickMevzek You are right - I have misinterpreted my test result. I had generated a DER certificate using certreq under Windows, which produced a certificate file. I imported that file into the certificate store, and the service in question could use it then, which means that there must have been a private key, and originally I thought that that key must have been in the DER file. In the meantime, I have noticed that certreq creates that key as a separate file in C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys whenever a DER certificate is created. I'll update my question. – Binarus Oct 3 '19 at 7:15
  • @PatrickMevzek I you write an answer, stating that this can't be done despite my statement in the question, I'll happily upvote and accept it. – Binarus Oct 3 '19 at 7:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.