In
cryptography, PKCS #12 defines an
archive file format for storing many cryptography objects as a single file. It is commonly used to bundle a
private key with its
X.509 certificate or to bundle all the members of a
chain of trust
In computer security, a chain of trust is established by validating each component of hardware and software from the end entity up to the root certificate. It is intended to ensure that only trusted software and hardware can be used while still ...
.
A PKCS #12 file may be encrypted and signed. The internal storage containers, called "SafeBags", may also be encrypted and signed. A few SafeBags are predefined to store certificates, private keys and
CRL CRL may refer to:
Organisations Science and technology research
* Chalk River Laboratories, a Canadian nuclear research center
* Charles River Laboratories, an American biomedical company
* Computational Research Laboratories, an Indian computer c ...
s. Another SafeBag is provided to store any other data at individual implementer's choice.
PKCS #12 is one of the family of standards called
Public-Key Cryptography Standards (PKCS) published by
RSA Laboratories.
The
filename extension for PKCS #12 files is
.p12 or
.pfx.
These files can be created, parsed and read out with the
OpenSSL
OpenSSL is a software library for applications that provide secure communications over computer networks against eavesdropping or need to identify the party at the other end. It is widely used by Internet servers, including the majority of HTT ...
pkcs12 command.
Relationship to PFX file format
PKCS #12 is the successor to
Microsoft's "PFX";
however, the terms "PKCS #12 file" and "PFX file" are sometimes used interchangeably.
The PFX format has been criticised for being one of the most complex cryptographic protocols.
Normal usage
The full PKCS #12 standard is very complex. It enables buckets of complex objects such as
PKCS #8 structures, nested deeply. But in practice it is normally used to store just one private key and its associated certificate chain.
PKCS #12 files are usually created using
OpenSSL
OpenSSL is a software library for applications that provide secure communications over computer networks against eavesdropping or need to identify the party at the other end. It is widely used by Internet servers, including the majority of HTT ...
, which only supports a single private key from the command line interface. The Java keytool can be used to create multiple "entries" since Java 8, but that may be incompatible with many other systems. As of Java 9, PKCS #12 is the default keystore format.
A simpler, alternative format to PKCS #12 is
PEM which just lists the certificates and possibly private keys as
Base 64 strings in a text file.
GnuTLS's ''certtool'' may also be used to create PKCS #12 files including certificates, keys, and CA certificates via --to-p12. However, beware that for interchangeability with other software, if the sources are in PEM Base64 text, then --outder should also be used.
References
External links
* - PKCS #12: Personal Information Exchange Syntax v1.1
*
* Overview about PKCS#12 capabilities, usage, implementations, history and future:
Cryptography standards
{{Crypto-stub