为何使用OpenSSL pkcs12命令时，加了-clcerts仍需-nokeys参数？

Great question—let's break down what each flag does and why you need both for your mutual TLS setup with cURL:

What -clcerts actually does #

The -clcerts flag tells OpenSSL to only extract client/end-entity certificates from the PKCS#12 file, ignoring any CA certificates (like intermediate or root CAs) that might be bundled in the keystore. This ensures you get just the certificate that identifies your client, not the full trust chain.

Why -nokeys is still necessary #

Here's the key detail: PKCS#12 files are designed to bundle both certificates and their corresponding private keys. Even when you use -clcerts to filter which certificates are extracted, OpenSSL will still try to include the private key linked to that client certificate in the output—unless you explicitly block it with -nokeys.

If you skip -nokeys, your client-certificate.pem file will end up with two distinct sections:

• The client certificate (wrapped in -----BEGIN CERTIFICATE-----/-----END CERTIFICATE-----)
• The private key for that certificate (wrapped in -----BEGIN PRIVATE KEY-----/-----END PRIVATE KEY----- or similar)

For cURL mutual TLS, you need separate files: one for the certificate (to present to the server) and one for the private key (to sign your requests). Mixing the private key into the certificate file is unnecessary, and it’s also a security risk if that file gets exposed accidentally.

To sum up #

• -clcerts: Controls which certificates are extracted (only your client cert, not CA chain certs)
• -nokeys: Controls whether private keys are excluded from the output

Together, they give you a clean, private-key-free client certificate file—exactly what you need for your cURL setup.

内容的提问来源于stack exchange，提问作者Nate