如何通过公钥与私钥文件创建PFX格式证书文件？

Hey there! Since you already have your private key and public key files ready, let's break down exactly how to generate a PFX (PKCS#12) file—this is super straightforward with OpenSSL, the go-to tool for this kind of crypto task.

First, a quick heads-up: PFX files typically bundle a private key with its corresponding certificate (which already includes the public key). If your "public key" is just a raw public key file (like public.key or public.pub), we’ll need to first create a self-signed certificate from it. If it’s already a certificate file (like cert.crt or cert.pem), we can jump straight to packing everything into PFX.

Case 1: Your public key is already a certificate file (.crt/.cer/.pem) #

If you have:

• Private key file: e.g., private.key (PEM format)
• Certificate file: e.g., cert.crt (contains your public key and issuer info)

Run this OpenSSL command in your terminal:

openssl pkcs12 -export -out output.pfx -inkey private.key -in cert.crt

Let’s break down what each part does:

• -export: Tells OpenSSL we’re creating a PKCS#12 export file
• -out output.pfx: The name of the final PFX file we’re generating
• -inkey private.key: Points to your private key file
• -in cert.crt: Points to your certificate (which holds your public key)

When you run this, you’ll be prompted to set a password for the PFX file—don’t forget this password! You’ll need it to import the PFX later.

Case 2: You have a raw public key file (not a certificate) #

If your public key is a raw file (like public.pub), first we need to create a self-signed certificate using both your public and private keys.

Step 1: Create a self-signed certificate #

Run this command to generate a valid certificate (cert.crt) from your keys:

openssl req -new -x509 -days 365 -key private.key -pubkey -in public.key -out cert.crt

(Adjust the -days value to set how long the certificate stays valid—365 is one year, but you can use any number you want.)

Step 2: Generate the PFX file #

Now use the same command from Case 1 to bundle the private key and new certificate into a PFX:

openssl pkcs12 -export -out output.pfx -inkey private.key -in cert.crt

Again, you’ll be asked to set a password for the PFX file—keep it safe!

Quick Troubleshooting Tips #

• Ensure your private key is in PEM format (starts with -----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY-----). If it’s in DER format, convert it first with:

  openssl rsa -inform DER -in private.key.der -out private.key.pem
  

• If you get an error about "no certificate matches private key", double-check that your public key/certificate was generated from the same private key—they have to be a matching pair!
• Store your PFX file and password securely—this file contains your private key, which is sensitive information.

内容的提问来源于stack exchange，提问作者theCode