So, we were trying to setup communication with the apple MFi server for staging.
Have followed the steps as per the documentation which state that the license server should be trusted (DigiCert certificate used for the same) and that the client certificate must be provided to apple in order to establish a secure tunnel.
The client certificates (.pem files) we are trying with were generated a few months back but are still valid. The .pem doesn't seem to authorize a machine but rather a company account, correct me if I'm wrong here. (So it should work if the csr for the pem files was not generated from the licensee server?)
Also, while trying to create a new certificate get a MAX_REQUEST error. Got conflicting information about whether there can be more than to certificates active for the staging profile for an account.
Tried through Postman as well as .NET
var handler = new HttpClientHandler();
handler.ClientCertificateOptions = ClientCertificateOption.Manual;
handler.SslProtocols = SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12;
handler.ClientCertificates.Add(new X509Certificate("Certificate.pem"));
var httpClient = new HttpClient(handler)
// Tried with and without the user name
httpClient.DefaultRequestHeaders.TryAddWithoutValidation("User-Agent",
"Company Name/Client Name/Client Version");
var result = httpClient.GetAsync(StagingURL).Result;
Always get a 401, Unauthorized Access error from the Apple Server. Wanted to know what the cause might be.
Thanks in advance!
Apparently, indeed only two staging certificates can be active at one time.
As for the certificate issue, .pem parsing might have been an issue but did not work with a .cer file either. The .pem only had the public key in it, needed to create a .p12 with the .pem and the private key that was used for generating the .csr.
If you are on a mac you should get it right away, on Windows, I had .jks file and had to create a .key file out of it:
keytool -importkeystore -srckeystore mykey.jks -destkeystore keystore.p12 -deststoretype PKCS12
openssl pkcs12 -in keystore.p12 -nocerts -nodes -out mykey.key
And then wrap the two in a .p12
openssl pkcs12 -export -in mycert.pem -inkey mykey.key -out myp12.p12
Could you please help me to use JFrog Artifactory certificates feature. (Admin -> Certificates).
I want to add certificate for a maven repository (https://plugins.jenkins.io/repository)
Below are the steps I followed –
Step1: Downloaded the certificate (DER encoded binary X.509) for this repository from chrome browser.
Step2: Converted certificate extension from .cer to .pem. Directly converted extension from .cer to .pem and tried with open ssl also openssl x509 -inform der -in certificate.cer -out certificate.pem
Step3: Add new certificate via (Admin -> Certificates -> New -> Drag and dropped .pem file), Entered Certificate Alias name.
After clicking on Save, I am getting below error –
Certificate could not be added. Unable to read the provided PEM file. Missing private key or certificate.
Other important information –
When I researched more on this error, I found jfrog is expecting certificate and private key both in .pem file. When I am downloading certificate from chrome I am getting only certificate but not private key.
https://jfrog.com/knowledge-base/how-to-resolve-the-certificate-could-not-be-added-unable-to-read-the-provided-pem-file-missing-key-or-certificate/
I have tried the above steps with Base-64 encoded X.509 certificate also but results are same.
What you are doing is adding client certificate.
Meaning that when Artifactory will access a remote repository, it will secure the connection using client certificate.
If your problem is that Artifactory does not trust the certificate exposed by the remote repo (https://plugins.jenkins.io/repository) then you need to follow the directions here:
https://www.jfrog.com/confluence/display/RTF/Using+a+Self-Signed+Certificate
More explanations about the differences:
https://www.websecurity.symantec.com/security-topics/client-certificates-vs-server-certificates
Please elaborate a little bit more about the original problem you had, so we could understand if you are picking the right solution.
Good luck.
Your certificate probably came from a CSR (certificate request)?
You should have a private key within that CSR request file. Simply paste the output CER text (enclosed by ----- BEGIN CERTIFICATE ... -----END CERTIFICATE) - ie your issued certificate, a blank line, then the similar ---- BEGIN PRIVATE KEY ... ---- END PRIVATE KEY section from the CSR into a simple file called < whatever >.PEM and put that into jfrog. I told Jfrog just yesterday that this part is not clear, and could be expressed more simply in their wiki. What its complaining about is the lack of a PRIVATE KEY entry in the PEM. It took me a while to realise this, and where to get it from.
I need help with configuring ssl certificate on google cloud. I've already obtained my ssl certificate (crt file & private key). And I've followed the link trying to create a "SSL certificate resource".
I've tried everything but the cmd below just doesn't work:
gcloud compute ssl-certificates create cert --certificate /opt/bitnami/etc/
smartmeetingroom_tk.crt --private-key /opt/bitnami/etc/serv.key
The error message I got is:
Could anyone tell me what is wrong with my command (or file)?
Thanks a million!!
update:
below is the screenshot of error msg when I add "--verbosity debug":
I obtained ssl certificate from this website.
BTW the crt & private key is already pem encoded. Cos they are all readable using text editor and:
The start&end of crt file looks like:
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
The start&end of private key file looks like:
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
Do you have read permissions for those files?
As suggested, add verbosity flag for more details.
If you are trying to create SSL certificate for HTTPS load balancer- I'd suggest using Google's managed certificate
As described here, you can try your command with the equals sign as follows:
gcloud compute ssl-certificates create cert --certificate=/opt/bitnami/etc/smartmeetingroom_tk.crt --private-key=/opt/bitnami/etc/serv.key
Consider:
A managed SslCertificate is provisioned and renewed for you. A self-managed certificate is created by passing the certificate obtained from Certificate Authority through --certificate and --private-key flags.
The certificate must be in PEM format. The certificate chain must be no greater than 5 certs long. The chain must include at least one intermediate cert.
The private key must be in PEM format and must use RSA or ECDSA encryption.
If the certificate is PEM formatted, check the following as established in the official documentation:
You can validate your certificate using the following OpenSSL command, replacing CERTIFICATE_FILE with the path to your certificate file:
openssl x509 -in CERTIFICATE_FILE -text -noout
If OpenSSL is unable to parse your certificate:
Contact your CA for help.
Create a new private key and certificate.
I recently got this problem and the issue was due to certificate holding an passkey phrase. So you need to remove that to fix this for GCP.
https://cloud.google.com/load-balancing/docs/ssl-certificates/troubleshooting
Run below via Powershell to generate new file without privatekey phrase
openssl rsa -in sample.pem -out samplewopk.pem
this fixed the issue
If the key happens to be encrypted using ecparam -name prime256v1 (that was my case) you should add "EC" to both
-----BEGIN PRIVATE KEY-----
your_key_content_here
-----END PRIVATE KEY-----
so, you key file will look like:
-----BEGIN EC PRIVATE KEY-----
your_key_content_here
-----END EC PRIVATE KEY-----
After this change it worked for me.
This might be helpful to someone else even after four years the original question was asked (It'll save me plenty of time)
Before questioning here. I've searched a lot about my problem. And problem is still exists. Below is the references of posts, which I've already read.
How to create .pfx file from certificate and private key?
Convert a CERT/PEM certificate to a PFX certificate
How to get .pem file from .key and .crt files?
How to generate a .pfx file from a .cer file?
Overview
I'm working on:
Windows 10 64bit
IIS (Version 10.0.16299.15)
I've installed Win32 OpenSSL v1.1.0g
These are the files that I have available:
server.cer
server.key
What I've tried?
I have also tried various things from trawling through posts but my lack of experience in this area is really impeding my efforts.
Below commands I have tried in Terminal to create my server.key and server.cer file.
set RANDFILE=c:\certificate\.md
set OPENSSL_CONF=c:\OpenSSL-Win32\bin\openssl.cfg
c:\OpenSSL-Win32\bin\openssl.exe genrsa -out server.key 2048`
c:\OpenSSL-Win32\bin\openssl.exe req -new -key server.key -out server.cer -config C:\OpenSSL-Win32\bin\openssl.cfg
c:\OpenSSL-Win32\bin\openssl.exe pkcs12 -export -in server.cer -inkey server.key -out server.pfx
Output
Error: unable to load certificates
What I want?
How to create .pfx file from certificate and private key? Let me know what I'm doing wrong in my code.
Although, the question is answered, I would like to add a simpler solution.
There is no need to use any 3rd party tools (including OpenSSL) on Windows. You can use built-in certutil.exe tool. Place both files in the same folder and give the same name to files (e.g. server.cer and server.key) and run the following command:
certutil -mergepfx path\server.cer
Certutil will expect to find a key file in the same folder with .key file extension.
The req command creates a certificate request by default, not a certificate. If you add the -x509 argument, it will self-sign the request using the provided key, and output a certificate instead. You should then be able to create the .pfx successfully.
I need .pfx file to install https on website on IIS.
I have two separate files: certificate (.cer or pem) and private key (.crt) but IIS accepts only .pfx files.
I obviously installed certificate and it is available in certificate manager (mmc) but when I select Certificate Export Wizard I cannot select PFX format (it's greyed out)
Are there any tools to do that or C# examples of doing that programtically?
You will need to use openssl.
openssl pkcs12 -export -out domain.name.pfx -inkey domain.name.key -in domain.name.crt
The key file is just a text file with your private key in it.
If you have a root CA and intermediate certs, then include them as well using multiple -in params
openssl pkcs12 -export -out domain.name.pfx -inkey domain.name.key -in domain.name.crt -in intermediate.crt -in rootca.crt
If you have a bundled crt file that you use, for example, with nginx, you can pass that in along with the cert all in one:
cat domain.name.crt | tee -a domain.name.bundled.crt
cat intermediate.crt | tee -a domain.name.bundled.crt
cat rootca.crt | tee -a domain.name.bundled.crt
openssl pkcs12 -export -out domain.name.pfx \
-inkey domain.name.key \
-in domain.name.bundled.crt
You can install openssl from here: openssl
If you're looking for a Windows GUI, check out DigiCert. I just used this and it was fairly simple.
Under the SSL tab, I first Imported the Certificate. Then once I selected the Certificate I was able to export as a PFX, both with and without a keyfile.
https://www.digicert.com/util
The Microsoft Pvk2Pfx command line utility seems to have the functionality you need:
Pvk2Pfx (Pvk2Pfx.exe) is a command-line tool copies public key and private key information contained in .spc, .cer, and .pvk files to a Personal Information Exchange (.pfx) file.
http://msdn.microsoft.com/en-us/library/windows/hardware/ff550672(v=vs.85).aspx
Note: if you need/want/prefer a C# solution, then you may want to consider using the http://www.bouncycastle.org/ api.
You do NOT need openssl or makecert or any of that. You also don't need the personal key given to you by your CA. I can almost guarantee that the problem is that you expect to be able to use the key and cer files provided by your CA but they aren't based on "the IIS way".
SSL Certs for IIS with PFX once and for all - SSL and IIS Explained - http://rainabba.blogspot.com/2014/03/ssl-certs-for-iis-with-pfx-once-and-for.html
Use IIS "Server Certificates" UI to "Generate Certificate Request" (the details of this request are out of the scope of this article but those details are critical). This will give you a CSR prepped for IIS. You then give that CSR to your CA and ask for a certificate. Then you take the CER/CRT file they give you, go back to IIS, "Complete Certificate Request" in the same place you generated the request. It may ask for a .CER and you might have a .CRT. They are the same thing. Just change the extension or use the . extension drop-down to select your .CRT. Now provide a proper "friendly name" (*.yourdomain.example, yourdomain.example, foo.yourdomain.example, etc..) THIS IS IMPORTANT! This MUST match what you setup the CSR for and what your CA provided you. If you asked for a wildcard, your CA must have approved and generated a wildcard and you must use the same. If your CSR was generated for foo.yourdomain.example, you MUST provide the same at this step.
Solution for Windows that doesn't require OpenSSL installed
I recently was trying to solve the same issue - and I only had a windows laptop with no openssl installed (and no enough admin rights to install it). Turns out windows has built-in utility called certutil that is capable of combining .crt and .key files into .pfx. Docs are here.
You need to create a new folder and place you .crt and key files in it. Rename both files to have the same name (but different extension):
{{sitename}}.crt
{{siteName}}.key
In case your key file is a regular txt - just change extension to .key.
After that open cmd in that folder and run certutil -mergepfx [INPUTFILE] [OUTPUTFILE]
Example:
certificate file: mySite.crt
key file: mySite.key
certutil command: certutil -mergepfx mySite.crt mySite.pfx
Note: you will be asked to provide password for newly created .pfx file - don't forget to memorise/store it - as it will be required during certificate import on the target system.
I created .pfx file from .key and .pem files.
Like this openssl pkcs12 -inkey rootCA.key -in rootCA.pem -export -out rootCA.pfx
https://msdn.microsoft.com/en-us/library/ff699202.aspx
(( relevant quotes from the article are below ))
Next, you have to create the .pfx file that you will use to sign your deployments. Open a Command Prompt window, and type the following command:
PVK2PFX –pvk yourprivatekeyfile.pvk –spc yourcertfile.cer –pfx yourpfxfile.pfx –po yourpfxpassword
where:
pvk - yourprivatekeyfile.pvk is the private key file that you created in step 4.
spc - yourcertfile.cer is the certificate file you created in step 4.
pfx - yourpfxfile.pfx is the name of the .pfx file that will be creating.
po - yourpfxpassword is the password that you want to assign to the .pfx file. You will be prompted for this password when you add the .pfx file to a project in Visual Studio for the first time.
(Optionally (and not for the OP, but for future readers), you can create the .cer and .pvk file from scratch) (you would do this BEFORE the above). Note the mm/dd/yyyy are placeholders for start and end dates. see msdn article for full documentation.
makecert -sv yourprivatekeyfile.pvk -n "CN=My Certificate Name" yourcertfile.cer -b mm/dd/yyyy -e mm/dd/yyyy -r
From this links:
https://serverfault.com/a/224127/569310
https://stackoverflow.com/a/49784278/7856894
https://stackoverflow.com/a/17284371/7856894
If you need, use this simple command sequence with OpenSSL to generate filessl.key (SSL certificate key file), and filessl.crt (SSL certificate file):
openssl genrsa 2048 > filessl.key
chmod 400 filessl.key
openssl req -new -x509 -nodes -sha256 -days 365 -key filessl.key -out filessl.crt
Until here you must respond to the interactive form (you can find reference info like req.cnf from this other post: https://stackoverflow.com/a/49784278/7856894)
Then, continue with this last command, which will ask you type the Export Password:
openssl pkcs12 -export -out filessl.pfx -inkey filessl.key -in filessl.crt
Ready, it generated your SSL certificate file in .PFX (or .P12) format: filessl.pfx.
This is BY FAR the easiest way to convert *.cer to *.pfx files:
Just download the portable certificate converter from DigiCert:
https://www.digicert.com/util/pfx-certificate-management-utility-import-export-instructions.htm
Execute it, select a file and get your *.pfx!!
You need to use the makecert tool.
Open a command prompt as admin and type the following:
makecert -sky exchange -r -n "CN=<CertificateName>" -pe -a sha1 -len 2048 -ss My "<CertificateName>.cer"
Where <CertifcateName> = the name of your cert to create.
Then you can open the Certificate Manager snap-in for the management console by typing certmgr.msc in the Start menu, click personal > certificates > and your cert should be available.
Here is an article.
https://azure.microsoft.com/documentation/articles/cloud-services-certs-create/
I got a link with your requirement.Combine CRT and KEY Files into a PFX with OpenSSL
Extracts from the above link:
First we need to extract the root CA certificate from the existing
.crt file, because we need this later. So open up the .crt and click
on the Certification Path tab.
Click the topmost certificate (In this case VeriSign) and hit View
Certificate. Select the Details tab and hit Copy to File…
Select Base-64 encoded X.509 (.CER) certificate Save it as rootca.cer
or something similar. Place it in the same folder as the other files.
Rename it from rootca.cer to rootca.crt Now we should have 3 files in
our folder from which we can create a PFX file.
Here is where we need OpenSSL. We can either download and install it
on Windows, or simply open terminal on OSX.
EDIT:
There is a support link with step by step information on how to do install the certificate.
After successfully install, export the certificate, choose .pfx format, include private key.
Important Note: : To export the certificate in .pfx format you need to follow the steps on the same machine from which you have requested the certificate.
The imported file can be uploaded to server.
When you say the certificate is available in MMC, is it available under "Current User" or "Local Computer"? I've found that I can only export the private key if it is under Local Computer.
You can add the snap in for Certificates to MMC and choose which account it should manage certificates for. Choose Local Computer. If your certificate is not there, import it by right clicking the store and choosing All Tasks > Import.
Now navigate to your imported certificate under the Local Computer version of the certificate snap in. Right click the certificate and choose All Tasks > Export. The second page of the export wizard should ask if you want to export the private key. Select Yes. The PFX option will now be the only one available (it is grayed out if you select no and the option to export the private key isn't available under the Current User account).
You'll be asked to set a password for the PFX file and then to set the certificate name.
I was trying openssl on macbook with libreSSL v2.8.3 and was getting error "No certificate matches private key". I had one domain cert, 2 intermediates and 1 root cert. So I used following command which worked successfully:
openssl pkcs12 -export -clcerts -inkey private.csr.key -in domain.name.crt -certfile intermediate1.crt -certfile intermediate2.crt -certfile root.crt -out domain.name.p12 -name "Your Name"
It will ask for a password that will be used during import. This command will generate a .p12 file which can be renamed to .pfx as both are same.
I was having the same issue. My problem was that the computer that generated the initial certificate request had crashed before the extended ssl validation process was completed. I needed to generate a new private key and then import the updated certificate from the certificate provider. If the private key doesn't exist on your computer then you can't export the certificate as pfx. They option is greyed out.
I would like to promote the "X certificate and key manager" or xca.exe, it's like a GUI version of OpenSSL. With that you can generate the pfx file by the following steps:
Import private key in the "Private Keys" tab;
Import the certificate in the "Certificates" tab;
Generate the pfx file by selecting the certificate and then "Export", select PKCS #12 as the format.
That's it.
In most of the cases, if you are unable to export the certificate as a PFX (including the private key) is because MMC/IIS cannot find/don't have access to the private key (used to generate the CSR). These are the steps I followed to fix this issue:
Run MMC as Admin
Generate the CSR using MMC. Follow this instructions to make the certificate exportable.
Once you get the certificate from the CA (crt + p7b), import them (Personal\Certificates, and Intermediate Certification Authority\Certificates)
IMPORTANT: Right-click your new certificate (Personal\Certificates) All Tasks..Manage Private Key, and assign permissions to your account or Everyone (risky!). You can go back to previous permissions once you have finished.
Now, right-click the certificate and select All Tasks..Export, and you should be able to export the certificate including the private key as a PFX file, and you can upload it to Azure!
Hope this helps!
I've written a small console app which converts a PEM certificate file and a private key file to one .pfx PKCS12 certificate file.
It uses BouncyCastle library.
My Github repo: https://github.com/nklkli/PEM-to-PKCS12
Feel free to modify the code to create password protected *.pfx.
openssl pkcs12 -export -in certificate.cer -inkey privateKey.key -out certificate.pfx