Create certificate .pem file from .pk12

create_pem_file.md

Generate .pem File from .p12 Certificate

This guide explains how to extract a .pem file from a .p12 file using OpenSSL and troubleshoot common errors encountered during the process.

1. Generate the .pem File

Run the following command to extract the .pem file:

openssl pkcs12 -in /Users/dvuiw/Desktop/customer.p12 -nokeys -out /Users/dvuiw/Desktop/certicate.pem -nodes -password pass:123456789

---

2. Troubleshooting Errors

2.1 Error: PKCS12 MAC Verification

Error Message:

Error verifying PKCS12 MAC; no PKCS12KDF support.
Use -nomacver if MAC verification is not required.

Solution:

Skip MAC verification by adding the -nomacver option:

openssl pkcs12 -in /Users/dvuiw/Desktop/customer.p12 -nokeys -out /Users/dvuiw/Desktop/certicate.pem -nodes -password pass:123456789 -nomacver

---

2.2 Error: Unsupported Algorithm

Error Message:

Error outputting keys and certificates
C0FA52EA01000000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:355:Global default library context, Algorithm (PKCS12KDF : 0), Properties (<null>)
C0FA52EA01000000:error:1180006B:PKCS12 routines:PKCS12_PBE_keyivgen_ex:key gen error:crypto/pkcs12/p12_crpt.c:55:

Solution:

Enable the legacy provider in OpenSSL.

1. Locate the OpenSSL Configuration File:

   openssl version -d

   Output:

   OPENSSLDIR: "/opt/homebrew/etc/openssl@3"

2. Edit the Configuration File: Open the OpenSSL configuration file for editing:

   vi /opt/homebrew/etc/openssl@3/openssl.cnf

   Add the following sections to enable the legacy provider:

   [default_sect]
   activate = 1
   
   [legacy_sect]
   activate = 1
   

3. Export the Configuration Path:

   export OPENSSL_CONF=/opt/homebrew/etc/openssl@3/openssl.cnf

4. Re-run the Command:

   openssl pkcs12 -in /Users/dvuiw/Desktop/customer.p12 -nokeys -out /Users/dvuiw/Desktop/certicate.pem -nodes -password pass:123456789 -nomacver

---

3. Verify the Certificate Expiration

To check the expiration date of the certificate, use one of the following commands:

Option 1: Direct Check

openssl x509 -enddate -noout -in certicate.pem

Option 2: Using cat

cat certicate.pem | openssl x509 -noout -enddate

Example Output:

notAfter=Dec  6 14:54:52 2026 GMT

---

Notes

• Ensure that the OpenSSL version you are using supports the necessary legacy algorithms.
• Use the -nomacver option only if MAC verification is not a strict requirement for your use case.