For testing purpose, I want to create a PKCS#12 file in which the private key doesn't match the certificate. Is there any tool which will help me do this?

If I use openssl pkcs12 -export command line to create the p12 file using a cert and a private key which are mismatched, then openssl gives me an error

No certificate matches private key

Is there an alternate tool/way to do this?

  • $\begingroup$ Interesting question, but I wonder what the test case would be. $\endgroup$ – Maarten Bodewes Jul 9 '13 at 21:18
  • $\begingroup$ @owlstead - test case would be to make sure that ownership of corresponding private key is verified. $\endgroup$ – user93353 Jul 10 '13 at 4:32
  • $\begingroup$ The Java JDK keytool has -storetype pkcs12 support and import/export/delete for certificates, but I will have to try the use case...in the weekend. Maybe try yourself. $\endgroup$ – Maarten Bodewes Jul 10 '13 at 9:28

You could try portecle. Import your keystore.p12 store, using the correct password of course or it will (silently) fail. Delete the certificate entry, and import a new "trusted" certificate entry.

Now it could be that some PKCS#12 defined attributes are different (e.g. friendlyName, which is visible as alias in portecle. Normally the key and certificate are linked through the modulus value however, so this should not make a difference for anybody trying to use the private key and certificate. It's probably best to copy the alias of the certificate just to be sure.

Portecle is written to use the Java KeyStore class, which supports PKCS#12 out of the box. The Java keytool utility uses the same class, but it seems to automatically delete certificates and keys together so it is not much use here.

| improve this answer | |
  • $\begingroup$ Import your keystore.p12 store - I don't have any store. I have a certificate+privatekey file in pkcs#12 format. Is portacle still relevant? Or do I have to first take my p12 file and put it into a java store & then do the portacle operations? $\endgroup$ – user93353 Jul 12 '13 at 15:51
  • $\begingroup$ For Java, on which portecle is build, the P12 file is the store. Java KeyStore supports multiple types of store, the native JKS (Java Key Store) but also PKCS#12 out of the box. Note that it does expect a DER/binary encoded key store (it does not understand OpenSSL PEM formatted/text format). $\endgroup$ – Maarten Bodewes Jul 12 '13 at 16:43
  • $\begingroup$ And, did you try my solution? $\endgroup$ – Maarten Bodewes Jul 14 '13 at 18:55
  • 1
    $\begingroup$ How do I delete the certificate entry? When I import my p12 file - I see 1 entry in the main window. When I right click & chose delete - I think it deletes the private key and not the certificate from the p12 file. $\endgroup$ – user93353 Jul 15 '13 at 11:25
  • $\begingroup$ Strange, I certainly saw two entries. I'll investigate... It probably depends on the "friendly name" within PKCS#12 $\endgroup$ – Maarten Bodewes Jul 15 '13 at 13:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.