If you have multiple servers on different platforms that need to use the same SSL certificate, such as in a load-balancer environment or UC SSL certificates, you can export the certificate from the Windows certificate store to .pfx file and then convert the file to individual certificate and private key files and use it on an Apache server or anything else which requires the public and private keys in plain text in separate files. You should take care to prevent unauthorized access to the private key, since with this file a rogue server could be set up to perform a man-in-the-middle attack or client traffic could be routed to this rogue server via a dns exploit or social engineering.
If you are looking for a good windows port of OpenSSL, I typically use Win32 OpenSSL v1.0.0d Light version from: http://www.slproweb.com/products/Win32OpenSSL.html
Exporting to a PFX file:
Click on the Start menu and click Run.
Type in mmc and click OK.
Click on the File menu and click Add/Remove Snap-in...
Click on the Add button. Double-click on Certificates.
Click on Computer Account and click Next.
Leave Local Computer selected and click Finish.
Click the Close button. Click OK.
Click the plus sign next to Certificates in the left pane.
Click the plus sign next to the Personal folder and click on the Certificates folder. Right-click on the certificate you would like to export and select All Tasks and then Export...
In the Certificate Export Wizard click Next
Choose "Yes, export the private key" and click Next.
Click the checkbox next to "Include all certificates in the certification path if possible" and click, Next.
Enter and confirm a password. This password will be needed whenever the certificate is imported to another server. (you will also need this password when processing this file with OpenSSL in a few more steps)
Click Browse and find a location to save the .pfx file to. Type in a name such as "myEncryptedCert.pfx" and then click Next.
Click Finish. The .pfx file containing the certificates and the private key is now saved to the location you specified.
Converting the PFX using OpenSSL:
Run the openssl command from where it was installed to from a command prompt:
openssl pkcs12 -in myEncryptedCert.pfx -out myPlaintextCert.txt –nodes
In the “myPlainTestCert.txt” file will be the public and private key. These can be copied into their own files if the public and private keys need to be in seperate files.
Private key will starts with “-----BEGIN RSA PRIVATE KEY-----“
Public key starts with “-----BEGIN CERTIFICATE-----“
- Chad Manzer's blog
- Login or register to post comments
