How to convert .p12 to .crt file?

Question

Can anyone tell me the correct way/command to extract/convert the certificate .crt file from a .p12 file? After I searched. I found the way how to convert .pem to .crt. but not found .p12 to .crt.

Solution 1

Try with given command

openssl pkcs12 -in filename.p12 -clcerts -nokeys -out filename.crt

Solution 2

You tagged 'keytool'. If you mean Java keytool, which is not the only one, it can do this:

    keytool -keystore in.p12 -storetype pkcs12 -exportcert -file out.crt -rfc -alias $name
    # for java9 up omit -storetype pkcs12 -- it's now default
    # -rfc gives PEM form; omit for DER form
    # can omit -alias $name if 'friendlyname' is mykey -- 
    # but that's likely only for stores created _with_ keytool 
    # because other tools and users mostly don't use that name

(but personally I'd use openssl as in crack_it's answer).

Solution 3

openssl pkcs12 -in filename.p12 -clcerts -nokeys -out filename.crt

Don't work form me

Comments

[duct_tape_coder]

Why would you use openssl instead of Java keytool? It's a far more common tool on the windows side. And how can you export the .key file from the .p12 using java keytool?

[dave_thompson_085]

@duct_tape_coder: I'm not quite clear which you say is common, but I've not seen Java preinstalled on any Windows since 98, or OpenSSL ever. And IME many enterprise environments (business, government, etc) prohibit Java on client machines because it was a nearly continous source of security vulnerabilities and breaches for 20 years (although conversely some require it for inhouse apps), while I've never seen a specific ban on OpenSSL (though it is covered by any blanket ban). Anyway, keytool cannot export privatekeys; this Q is only for the cert, which is why I gave this answer.