Export public-private keys from PFX file

In this blog I'll share the snippets used to export the public key & private key from a PFX file. Sometimes we have to perform the data encryption/decryption using the digital signature by taking the public key(so called as SSL certificate or public keys)  to encrypt the data and private key to decrypt the data.

Let's take the sample DSCs provided by eMudhra- https://www.e-mudhra.com/Repository/

I have taken "e-Mudhra sub CA for Class 3 Individual 2014" for this blog. This zip contains two files as-

1. Class 3 individiual test_encryption.pfx- For data encryption/decryption
2. Class 3 individiual test_Signature.pfx- For signing the document

We'll take the file Class 3 individiual test_encryption.pfx for this blog and follow the below steps to obtain the public key & private key.

• A linux machine with openssl utility
• Run the following command to extract the private key

openssl pkcs12 -in Class_3_individiual_test_encryption.pfx -nocerts -out private_key.key

If prompted,enter the password- emudhra

• Run the following command to decrypt the private key

openssl rsa -in private_key.key -out private_key-decrypted.key

• Run the following command to extract the certificate

openssl pkcs12 -in Class_3_individiual_test_encryption.pfx -clcerts -nokeys -out public_key.crt

So, finally we have our-

Public key- public_key.crt

Private Key- private_key-decrypted.key

-----------------------------------------------------------------

Below commands to follow to convert PFX to JKS file-

-----------------------------------------------------------------

Create JKS

keytool -importkeystore -srckeystore e-Mudhra_Sub_CA_for_Class_3_Individual_2022.pfx -srcstoretype pkcs12  -destkeystore em_clientcert.jks -deststoretype JKS

Convert JKS to pkcs12 format

keytool -importkeystore -srckeystore em_clientcert.jks -destkeystore em_clientcert.jks -deststoretype pkcs12

-----------------------------------------------------------------

Below commands to follow to obtain CER from JKS-

-----------------------------------------------------------------

Export the PEM from JKS

keytool -exportcert -alias test1 -keystore em_clientcert.jks -rfc -file em_clientCRT.pem

Convert pem to DER

openssl x509 -outform der -in em_clientCRT.pem -out em_clientCRT.der

Convert DER to CER

openssl x509 -inform der -in em_clientCRT.der -out em_clientCRT.cer

Ref: 

https://www.ibm.com/docs/en/arl/9.7?topic=certification-extracting-certificate-keys-from-pfx-file

https://stackoverflow.com/questions/4217107/how-to-convert-pfx-file-to-keystore-with-private-key

https://www.howtouselinux.com/post/converting-cer-crt-der-pem-pfx-certificate

https://www.httpcs.com/en/ssl-converter