Convert certificate formats

Sooner or later a platform refuses your neat pile of .crt and .key files and demands “a PKCS#12 file” or “a .pfx”. Nothing about the cryptography changes — it is the same key and the same certificates in a different container. Knowing the two main containers saves you from panicked searching at deploy time.

PEM is what we have used all course: text files with -----BEGIN CERTIFICATE----- markers, one concern per file. PEM commonly stores text-encoded certificates and keys in separate files, which is why servers like nginx and Node take separate cert and key paths.

PKCS#12 (extensions .p12 or .pfx) is a binary bundle. It can package a key, leaf, and chain under password protection in a single file. Browsers importing a client certificate, Java keystores, and Windows services usually want this one.

Create a lab client bundle from the mTLS files:

openssl pkcs12 -export -out client.p12 -inkey client.key -in client.crt -certfile lab-ca.crt

-export switches pkcs12 into bundle-creation mode. -inkey and -in take the private key and its certificate; -certfile adds the CA certificate so the receiving system gets the chain context too. You are prompted for an export password — choose a real one, because this file contains the private key and will probably travel to another machine, which is exactly when files get copied around carelessly.

Check what landed inside without decrypting the secrets to your terminal:

openssl pkcs12 -in client.p12 -info -noout
# MAC: sha256, Iteration 2048
# PKCS7 Encrypted data: ...
# Certificate bag
# Certificate bag
# Shrouded Keybag: ...

List the bundle structure with -info -noout: two certificate bags (the client certificate and the CA) and one shrouded key bag (the encrypted private key). Avoid printing private key material — if you ever extract back to PEM, be aware the output includes the decrypted key, so send it to a protected file, never to a shared screen or log.

The failure mode here is not technical but operational: the bundle works, gets mailed around “because it’s just one file”, and now the private key exists in inboxes with a password sitting in the same thread. Format conversion does not improve a weak password or insecure file permissions. Treat a .p12 with the same care as the raw key, because that is what it contains.