What is a PKCS#12 File? (2024)

Editor's Note: As of 2024, this article has been reviewed and updated in accordance with the latest standards/conventions for PKCS#12.

A PKCS#12 or .pfx file is a file which contains both private key and X.509 certificate, ready to be installed by the customer into servers such as IIS, Apache Tomcat or Exchange. Certificate Signing Request (CSR) generation remains one of the consistent problem areas faced by customers wishing to secure their server. PKCS#12 removes the need for the customer to create their own CSR. Instead, a Certificate Authority securely creates the CSR on behalf of the customer during the certificate application process.

The Journey of a .pfx File

PKCS#12 files can be generated for Domain Validated SSL/TLS (DV) and Organization Validated SSL (OV) Certificates. Extended Validation Certificates SSL/TLS (EV) must go through the manual certificate signing request generation as the vetting process will not allow for automated CSR. When delivering Digital Certificates and private keys to Document Signing Certificate or Code Signing Certificate orders (except for Java) .pfx file delivery is the default. Here's what you need to know about the process from application to installation.

Application

During the application process, instead of asking you to generate your own CSR, you are promoted to a password for your PKCS#12 file. This password is concatenated with a GlobalSign system generated password to provide a long and strong password, which is needed to decrypt and install the PKCS#12 once delivered. We then delete the PKCS#12 from our system after 30 days, for security. You are also asked for the DN (Distinguished Name) information needed to issue the certificate. For the two types of certificates available, the DN requirements are:

Domain Validated SSL/TLS: the certificate common name (the domain where the certificate will be used) and country.

Organization Validated SSL/TLS: the certificate common name (the domain name where the certificate will be used), organization name, department, state and country.

Vetting

Vetting is identical to standard applications and dependent on the certificate type.

Domain Validated SSL/TLS:

GlobalSign sends an approval email to the owner of the domain name referenced in the application. The domain owner / controller must approve the application. We also support DNS and meta-tag Domain Validation methods.

Organization Validated SSL/TLS:

GlobalSign validates company ownership via third-party databases and the applicant's right to use the domain referenced in the application.

Certificate Delivery

The issued certificate is delivered in a PKCS#12 file containing both private key and certificate. The PKCS#12 is made available to partners through GlobalSign's Certificate Center (GCC) or through our API. End customers can then install their PKCS#12 file using instructions from the GlobalSign Support Center.

How to Install a PKCS#12 or .pfx File

Instructions vary depending on your system and browser. You can find our installation guides in the list below.

GlobalSign Installation Guides

We offer several installation guides from our support website to help you download and install your PKCS#12 file with ease. If you have any problems don't hesitate to contact our support team.

Install PKCS#12 File - MAC OS Firefox
Install PKCS#12 File - Windows Using Opera
Install PKCS#12 File - Microsoft Exchange 2007
Install PKCS#12 File - Linux Ubuntu Using Chrome
Install AutoCSR/PFX/PKCS#12 - JBoss
Install AutoCSR/PFX/PKCS#12 - Internet Information Services (IIS) 7
Install PKCS#12 File - Linux Ubuntu Using Firefox
Install PKCS#12 File - Linux Ubuntu Using Opera
Install a PKCS#12 File - Android Devices
Install a PKCS#12 File - Document Signing Certificate

Is a PKCS#12 File Secure?

Often, we are asked about the level of security when generating a CSR for our customers. As we generate the private key ourselves, we must be extra careful to ensure it remains secure. To do this GlobalSign follows strict procedures and guidelines. The key pair is generated using random numbers depending on several factors. FIPS 140 Level 3 cryptographic hardware is utilized to generate your key pair and certificate request. Lastly, to secure the .pfx file in transit, GlobalSign uses a high protection password up to 50 characters in length, our system appends another eight random characters.

It is also worth noting that GlobalSign never stores the private keys of our customers on our own servers. Once your private key is sent, you then have complete access.

A PKCS#12 or .pfx file is a simpler way to create a Digital Certificate. It can save time and eliminate difficulty in generating your own CSR if you are less certain on how to do this. While generation of a .pfx file is not available for all Digital Certificates it does cover a range of solutions.

If you are looking to purchase a Digital Certificate with GlobalSign by generating a PKCS#12 file, then get in touch with us today or purchase your certificate through our website.

FAQs

What would a PKCS12 file commonly be used for? ›

PKCS#12 (also known as PKCS12 or PFX) is a binary format for storing a certificate chain and private key in a single, encryptable file. PKCS#12 files are commonly used to import and export certificates and private keys on Windows and macOS computers, and usually have the filename extensions . p12 or . pfx .

Read On ›

What is PKCS12 content? ›

The PKCS12 contains the X. 509 digital certificate that carries a copy of the public key of the subject (i.e. the VASP or entity being issued the certificate), as well as other standard fields. These certificates issued by the TRISA CA are used to identify and verify originating VASPs and beneficiary VASPs.

Discover More Details ›

What is the PKCS12 certificate format? ›

A PKCS#12 or . pfx file is a file which contains both private key and X. 509 certificate, ready to be installed by the customer into servers such as IIS, Apache Tomcat or Exchange. Certificate Signing Request (CSR) generation remains one of the consistent problem areas faced by customers wishing to secure their server.

What file should be of type P12? ›

PKCS#12 (P12) files define an archive file format for storing cryptographic objects as a single file. API Connect supports the P12 file format for uploading a keystore and truststore. The keystore should contain both a private and public key along with intermediate CA certificates.

See Details ›

Does PKCS12 require a private key? ›

PKCS #12 files are usually created using OpenSSL, which only supports a single private key from the command line interface.

Find Out More ›

What is the use of PKCS? ›

Public-Key Cryptography Standards (PKCS) are a set of standard protocols, numbered from 1 to 15. These standards were developed to enable secure information exchange on the internet by using a public key infrastructure (PKI).

Tell Me More ›

What is PKCS12 structure? ›

The PKCS #12 standard defines a structure that can contain the following: Private Key: The actual private key associated with the certificate. Certificate: The X. 509 certificate that corresponds to the private key.

Show Me More ›

How do I get my PKCS12 certificate? ›

You have to use the previously generated certificate to generate a PKCS#12 file.

Open the OpenSSL command prompt and type openssl to start the application.
Type the following command: pkcs12 -export -in C:\path\to\certificatename.crt -inkey C:\path\to\keyname.key -out C:\path\to\newpkcs12.pfx.

More items...

Explore More ›

How to view contents of PKCS12 file? ›

The OpenSSL command with the -info and -in options can be used to display the contents of the P12 file. You should be prompted to provide the password that was used to secure the P12 file. If you do not want to be prompted for the password, the password can be included on the command line.

How to decrypt a p12 file? ›

You can use following commands to extract public/private key from a PKCS#12 container:

PKCS#1 Private key openssl pkcs12 -in yourP12File.pfx -nocerts -out privateKey.pem.
Certificates: openssl pkcs12 -in yourP12File.pfx -clcerts -nokeys -out publicCert.pem.

Feb 29, 2012

Show Me More ›

Is PKCS12 safe? ›

PKCS12 (aka PFX) files, on the other hand, are language-neutral and is more secure and has been around long enough that it's supported just about everywhere. If you want to convert JKS (. jks) Keystore to a PKCS12 (. p12) Keystore, you can do so by executing the following command.

Read The Full Story ›

What is the p12 certificate file format? ›

p12 is an alternate extension for what is generally referred to as a "PFX file", it's the combined format that holds the private key and certificate and is the format most modern signing utilities use. If you have a . p12 file that you exported from Firefox or Safari just rename the .

See Details ›

How do I check if a p12 file is valid? ›

The certutil command will display detailed information about the certificates in the . p12 file, including their expiration dates. Look for the section that corresponds to your certificate, and you'll find the NotAfter field, which indicates the expiration date of the certificate. That's it!

Get More Info Here ›

How do I generate a p12 certificate? ›

Manually creating a P12 certificate

Log in on Apple Developer portal with your Enterprise account.
Click on Certificates, Identifiers & Profiles from the left sidebar.
Click on the plus icon on the top right to create a new certificate.
Choose In-House and Ad Hoc from the Production section and continue.

More items...

What is p12 used for? ›

p12 is an alternate extension for what is generally referred to as a "PFX file", it's the combined format that holds the private key and certificate and is the format most modern signing utilities use. If you have a . p12 file that you exported from Firefox or Safari just rename the . p12 extension to .

What is the use of p12 certificate? ›

A distribution certificate identifies your team/organization within a distribution provisioning profile and allows you to submit your app to the Apple App Store. A . p12 file contains the certificates Apple needs in order to build and publish apps.

View Details ›

What is the difference between JKS and PKCS12? ›

The biggest difference between JKS and PKCS12 is that JKS is a format specific to Java, while PKCS12 is a standardized and language-neutral way of storing encrypted private keys and certificates.

What is the difference between PKCS 11 and PKCS12? ›

PKCS 11 vs 12

PKCS 11 and PKCS 12 are part of the RSA Public Key Cryptography Standards. A simple usage summary of both is: PKCS12 is used to store private key and certificate information on files, and PKCS11 stores them on external devices.

Learn More ›