中文

Glossary

PKCS #12 (Personal Information Exchange Syntax (.p12 / .pfx))

Last verified

Definition

PKCS #12 is a password-protected binary container format that bundles a private key with its certificate and chain in one file, usually .p12 or .pfx.

PKCS #12, specified in RFC 7292, defines an archive that can hold private keys, certificates and CA certificates in a single DER-encoded file, with integrity protection and encryption derived from a password. It is the standard way to move a complete identity, a key plus its certificate chain, between systems, and the native import and export format of Windows, macOS Keychain, browsers and Java, which has used PKCS #12 as its default keystore type since Java 9.

Why it matters

Whenever a server or client needs the key and certificate together, PKCS #12 avoids juggling separate files, and the password gives some protection in transit. The algorithms inside matter for compatibility: OpenSSL 3.x creates files with AES-256 and PBKDF2 by default, while some older systems only understand the legacy RC2/3DES-based format, which OpenSSL produces with the -legacy option. See PFX for the Windows and IIS side of the same format.

Example

openssl pkcs12 -export -inkey example.com.key -in example.com.crt \
  -certfile chain.pem -name example.com -out example.com.p12
openssl pkcs12 -in example.com.p12 -info -noout
openssl pkcs12 -in example.com.p12 -nodes -out example.com-all.pem

Common misconceptions

  • .p12 and .pfx are different formats. They are the same PKCS #12 structure with different customary extensions.
  • The password makes the file safe to email. Weak passwords can be brute-forced offline; treat the file like a bare private key.
  • An import failure always means a wrong password. It can also mean the importing system does not support the encryption algorithm used in the file.

See also