# Creating a PKCS#12 file where public key doesn't match the private key

For testing purpose, I want to create a PKCS#12 file in which the private key doesn't match the certificate. Is there any tool which will help me do this?

If I use openssl pkcs12 -export command line to create the p12 file using a cert and a private key which are mismatched, then openssl gives me an error

No certificate matches private key


Is there an alternate tool/way to do this?

-
Interesting question, but I wonder what the test case would be. –  owlstead Jul 9 '13 at 21:18
@owlstead - test case would be to make sure that ownership of corresponding private key is verified. –  user93353 Jul 10 '13 at 4:32
The Java JDK keytool has -storetype pkcs12 support and import/export/delete for certificates, but I will have to try the use case...in the weekend. Maybe try yourself. –  owlstead Jul 10 '13 at 9:28

You could try portecle. Import your keystore.p12 store, using the correct password of course or it will (silently) fail. Delete the certificate entry, and import a new "trusted" certificate entry.
Now it could be that some PKCS#12 defined attributes are different (e.g. friendlyName, which is visible as alias in portecle. Normally the key and certificate are linked through the modulus value however, so this should not make a difference for anybody trying to use the private key and certificate. It's probably best to copy the alias of the certificate just to be sure.
Portecle is written to use the Java KeyStore class, which supports PKCS#12 out of the box. The Java keytool utility uses the same class, but it seems to automatically delete certificates and keys together so it is not much use here.
Import your keystore.p12 store - I don't have any store. I have a certificate+privatekey file in pkcs#12 format. Is portacle still relevant? Or do I have to first take my p12 file and put it into a java store & then do the portacle operations? –  user93353 Jul 12 '13 at 15:51