Use OpenSSL command to convert SSL certificate formats

Whether we buy an SSL certificate from a merchant or obtain a certificate for free, if we need to deploy it to a panel or server WEB environment, the corresponding format requirements may be different. For example, when a netizen deploys an SSL certificate in Mormon Cloud CDN, because it can only support PEM format certificates, it needs to convert the original certificates that may not be in the original format.

There are also many ways to convert formats. The simplest and most direct way is to directly use the OpenSSL software that comes with Linux. Lao Zuo is going to record the common format conversion (Certificates Formats) through this article.

Before we prepare the format conversion, we need to find a Linux VPS with OpenSSL software installed. If not, we can install it ourselves.

First, PEM to PKCS7

openssl crl2pkcs7 -nocrl -certfile your_pem_certificate.crt -out your_pkcs7_certificate.p7b

Second, PKCS7 to PEM

openssl pkcs7 -print_certs -in your_pkcs7_certificate.p7b -out your_pem_certificates.pem

Third, PEM to PFX

openssl pkcs12 -export -out your_pfx_certificate.pfx -inkey laozuo.key -in laozuo.crt

The password needs to be set twice for PFX. The password needs to be remembered, and it needs to be entered when importing to the project later.

Fourth, PFX to PEM

openssl pkcs12 -in your_pfx_certificate.pfx -out your_pem_certificates_and_key.pem -nodes

You need to prompt us to enter the password of the PFX certificate before transferring.

Fifth, PKCS7 to PFX

PKCS7 cannot be directly converted to PFX. We need to first convert PKCS7 to PEM and then PEM to PFX through the above method.

openssl pkcs7 -print_certs -in your_pkcs7_certificate.p7b -out your_pem_certificates.pem

openssl pkcs12 -export -out your_pfx_certificate.pfx -inkey your_private.key -in your_pem_certificate.crt

In conclusion, when converting the SSL certificate format, we need to throw some certificate formats to the current directory where the openssl conversion command is executed, and the file names need to correspond.