# info > openssl-pkcs12 --- type: CommandReference command: openssl pkcs12 mode: man section: 1SSL source: man-pages --- ## Quick Reference - `openssl pkcs12 -in file.p12 -out file.pem` — parse PKCS#12 to PEM - `openssl pkcs12 -in file.p12 -clcerts -out file.pem` — output only client certs - `openssl pkcs12 -in file.p12 -out file.pem -noenc` — don't encrypt private key - `openssl pkcs12 -in file.p12 -info -noout` — print file info without output - `openssl pkcs12 -in file.p12 -info -noout -legacy` — info in legacy mode - `openssl pkcs12 -export -in file.pem -out file.p12 -name "My PSE"` — create PKCS#12 from PEM - `openssl pkcs12 -export -in file.pem -out file.p12 -name "My PSE" -certfile othercerts.pem` — include extra certs - `openssl pkcs12 -export -in cert.pem -inkey key.pem -out file.p12 -legacy` — export with legacy defaults ## Name openssl-pkcs12 - PKCS#12 file command ## Synopsis `openssl pkcs12 [options]` General options: `[-help] [-passin arg] [-passout arg] [-password arg] [-twopass] [-in filename|uri] [-out filename] [-nokeys] [-nocerts] [-noout] [-legacy] [-engine id] [-provider name] [-provider-path path] [-propquery propq] [-rand files] [-writerand file]` PKCS#12 input (parsing) options: `[-info] [-nomacver] [-clcerts] [-cacerts] [-aes128] [-aes192] [-aes256] [-aria128] [-aria192] [-aria256] [-camellia128] [-camellia192] [-camellia256] [-des] [-des3] [-idea] [-noenc] [-nodes]` PKCS#12 output (export) options: `[-export] [-inkey filename|uri] [-certfile filename] [-passcerts arg] [-chain] [-untrusted filename] [-CAfile file] [-no-CAfile] [-CApath dir] [-no-CApath] [-CAstore uri] [-no-CAstore] [-name name] [-caname name] [-CSP name] [-LMK] [-keyex] [-keysig] [-keypbe cipher] [-certpbe cipher] [-descert] [-macalg digest] [-iter count] [-noiter] [-nomaciter] [-maciter] [-nomac]` ## Options ### General Options - `-help` — Print usage message - `-passin arg` — Password source for input and for encrypting private keys output. See [openssl-passphrase-options(1)](http://localhost/phpMan.php/man/openssl-passphrase-options/1/markdown) - `-passout arg` — Password source for output files - `-password arg` — With `-export`, equivalent to `-passout`; otherwise equivalent to `-passin` - `-twopass` — Prompt for separate integrity and encryption passwords (most software expects same). Cannot be used with `-password`, `-passin` (import) or `-passout` (export) - `-nokeys` — Do not output private keys - `-nocerts` — Do not output certificates - `-noout` — Inhibit all credential output; only verify input - `-legacy` — Use legacy mode, auto-load legacy provider. Default encryption AES-256-CBC with PBKDF2. Legacy uses RC2_CBC or 3DES_CBC for certs, 3DES_CBC for private keys - `-engine id` — Deprecated, see "Engine Options" in [openssl(1)](http://localhost/phpMan.php/man/openssl/1/markdown) - `-provider name` — See "Provider Options" in [openssl(1)](http://localhost/phpMan.php/man/openssl/1/markdown) - `-provider-path path` — Provider path - `-propquery propq` — Property query, see [property(7)](http://localhost/phpMan.php/man/property/7/markdown) - `-rand files` — Random state options, see [openssl(1)](http://localhost/phpMan.php/man/openssl/1/markdown) - `-writerand file` — Write random state to file ### PKCS#12 Input (Parsing) Options - `-in filename|uri` — Input file or URI. Default stdin. Without `-export`, must be PKCS#12 file - `-out filename` — Output file for certificates/private keys (PEM format). Default stdout - `-info` — Output additional info about PKCS#12 structure, algorithms, iteration counts - `-nomacver` — Skip integrity MAC verification - `-clcerts` — Output only client certificates (not CA) - `-cacerts` — Output only CA certificates (not client) - `-aes128|-aes192|-aes256` — Encrypt private keys with AES before output - `-aria128|-aria192|-aria256` — Encrypt with ARIA - `-camellia128|-camellia192|-camellia256` — Encrypt with Camellia - `-des` — Encrypt with DES - `-des3` — Encrypt with triple DES - `-idea` — Encrypt with IDEA - `-noenc` — Do not encrypt private keys - `-nodes` — Deprecated since OpenSSL 3.0, use `-noenc` ### PKCS#12 Output (Export) Options - `-export` — Create PKCS#12 file instead of parsing - `-out filename` — Output filename for PKCS#12 file. Default stdout - `-in filename|uri` — Input file with certificates and key, or URI for key via engine. Default stdin. With `-export`, one private key and its certificate should be present; additional certs included - `-inkey filename|uri` — Private key input for export. If missing, `-in` must contain private key. URI can be used with engine prefix - `-certfile filename` — Extra certificates to add to output - `-passcerts arg` — Password source for certificate input (-certfile, -untrusted). See [openssl-passphrase-options(1)](http://localhost/phpMan.php/man/openssl-passphrase-options/1/markdown) - `-chain` — Build and include certificate chain of end entity certificate. Uses standard CA trust store and any `-untrusted` certificates - `-untrusted filename` — Untrusted certificates for chain building (only with `-export` and `-chain`) - `-CAfile file`, `-no-CAfile`, `-CApath dir`, `-no-CApath`, `-CAstore uri`, `-no-CAstore` — Trusted certificate options, see [openssl-verification-options(1)](http://localhost/phpMan.php/man/openssl-verification-options/1/markdown) - `-name friendlyname` — Friendly name for certificates and private key (displayed in import software) - `-caname friendlyname` — Friendly name for other certificates (may be repeated) - `-CSP name` — Write Microsoft CSP name - `-LMK` — Add "Local Key Set" identifier to attributes - `-keyex|-keysig` — Mark key for key exchange or signing only (MSIE/Windows). `-keysig` allows signing only, used for S/MIME, authenticode, SSL client auth (MSIE 5.0+) - `-keypbe alg`, `-certpbe alg` — Encryption algorithm for private key and certificates. Any PKCS#5 v1.5, PKCS#12 PBE, or cipher name (PKCS#5 v2.0). Special value "NONE" disables encryption - `-descert` — Encrypt certificates with triple DES. Default AES-256-CBC unless `-legacy`. With `-legacy`, both key and certs use triple DES - `-macalg digest` — MAC digest algorithm (default SHA1) - `-iter count` — Iteration count for encryption key and MAC. Default 2048 - `-noiter`, `-nomaciter` — Set MAC and encryption iteration counts to 1 (reduces security). `-nomaciter` needed for MSIE 4.0 compatibility - `-maciter` — Included for compatibility; MAC iterations now default - `-nomac` — Do not provide MAC integrity. Useful with FIPS provider (PKCS12KDF not FIPS-approved) ## Notes - For parsing, only `-in` and `-out` are typically needed; for creation, `-export` and `-name`. - If none of `-clcerts`, `-cacerts`, `-nocerts` are given, all certs output in order. Use `-clcerts` to get the certificate matching the private key. CA certs can be output separately with `-nokeys -cacerts`. - `-keypbe` and `-certpbe` allow precise encryption algorithms. For 40-bit RC2 private key encryption: `-keypbe PBE-SHA1-RC2-40`. See [openssl-pkcs8(1)](http://localhost/phpMan.php/man/openssl-pkcs8/1/markdown). - Pre-1.1 passwords with non-ASCII characters used non-compliant encoding. Legacy encoding is attempted when reading; upgrade data for production. ## Examples shell # Parse a PKCS#12 file to PEM openssl pkcs12 -in file.p12 -out file.pem # Output only client certificates openssl pkcs12 -in file.p12 -clcerts -out file.pem # Don't encrypt private key openssl pkcs12 -in file.p12 -out file.pem -noenc # Print info about a PKCS#12 file openssl pkcs12 -in file.p12 -info -noout # Print info in legacy mode openssl pkcs12 -in file.p12 -info -noout -legacy # Create a PKCS#12 file from PEM openssl pkcs12 -export -in file.pem -out file.p12 -name "My PSE" # Include extra certificates openssl pkcs12 -export -in file.pem -out file.p12 -name "My PSE" -certfile othercerts.pem # Export with legacy default algorithms openssl pkcs12 -export -in cert.pem -inkey key.pem -out file.p12 -legacy ## See Also - [openssl(1)](http://localhost/phpMan.php/man/openssl/1/markdown) - [openssl-pkcs8(1)](http://localhost/phpMan.php/man/openssl-pkcs8/1/markdown) - [ossl_store-file(7)](http://localhost/phpMan.php/man/osslstore-file/7/markdown)