pk12util command examples

pk12util – Export and import keys and certificate to or from a PKCS #12 file and the NSS database

Importing Keys and Certificates

The most basic usage of pk12util for importing a certificate or key is the PKCS#12 input file (-i) and some way to specify the security database being accessed (either -d for a directory or -h for a token).

pk12util -i p12File [-h tokenname] [-v] [-d [sql:]directory] [-P dbprefix] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]

For example:

# pk12util -i /tmp/cert-files/users.p12 -d sql:/home/my/sharednssdb

Enter a password which will be used to encrypt your keys.
The password should be at least 8 characters long, and should contain at least one non-alphabetic character.
Enter new password:
Re-enter password:
Enter password for PKCS12 file:
pk12util: PKCS12 IMPORT SUCCESSFUL

Exporting Keys and Certificates

Using the pk12util command to export certificates and keys requires both the name of the certificate to extract from the database (-n) and the PKCS#12-formatted output file to write to. There are optional parameters that can be used to encrypt the file to protect the certificate material.

pk12util -o p12File -n certname [-c keyCipher] [-C certCipher] [-m|--key_len keyLen] [-n|--cert_key_len certKeyLen]
[-d [sql:]directory] [-P dbprefix] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]

For example:

# pk12util -o certs.p12 -n Server-Cert -d sql:/home/my/sharednssdb

Enter password for PKCS12 file:
Re-enter password:

Listing Keys and Certificates

The information in a .p12 file are not human-readable. The certificates and keys in the file can be printed (listed) in a human-readable pretty-print format that shows information for every certificate and any public keys in the .p12 file.

pk12util -l p12File [-h tokenname] [-r] [-d [sql:]directory] [-P dbprefix] [-k slotPasswordFile|-K slotPassword] [-w
p12filePasswordFile|-W p12filePassword]

For example, this prints the default ASCII output:

# pk12util -l certs.p12

Enter password for PKCS12 file:
Key(shrouded):
Friendly Name: Thawte Freemail Member's Thawte Consulting (Pty) Ltd. ID
Encryption algorithm: PKCS #12 V2 PBE With SHA-1 And 3KEY Triple DES-CBC
Parameters:
Salt:
45:2e:6a:a0:03:4d:7b:a1:63:3c:15:ea:67:37:62:1f
Iteration Count: 1 (0x1)
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 13 (0xd)
Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption
Issuer: "E=personal-freemail@thawte.com,CN=Thawte Personal Freemail C
A,OU=Certification Services Division,O=Thawte Consulting,L=Cape T
own,ST=Western Cape,C=ZA"

Alternatively, the -r prints the certificates and then exports them into separate DER binary files. This allows the certificates to be fed to another application that supports .p12 files. Each certificate is written to a sequentially-number file, beginning with file0001.der and continuing through file000N.der, incrementing the number  for every certificate:

pk12util -l test.p12 -r
Enter password for PKCS12 file:
Key(shrouded):
Friendly Name: Thawte Freemail Member's Thawte Consulting (Pty) Ltd. ID
Encryption algorithm: PKCS #12 V2 PBE With SHA-1 And 3KEY Triple DES-CBC
Parameters:
Salt:
45:2e:6a:a0:03:4d:7b:a1:63:3c:15:ea:67:37:62:1f
Iteration Count: 1 (0x1)
Certificate Friendly Name: Thawte Personal Freemail Issuing CA - Thawte Consulting
Certificate Friendly Name: Thawte Freemail Member's Thawte Consulting (Pty) Ltd. ID