How do i create the key and crt file from given code signing file cer only?

Question

I have code signing certificate, from them i got a X.cer file only.
when i need to sign my .exe i need a PFX file for that i need two files A.key and B.crt

Q. How do i make from X.cer file, A.key and B.crt? so that i can start Step 1?

Step 1:

$ openssl pkcs12 -inkey A.key -in B.crt -export -out GOAL.pfx

Step 2:

signtool sign /debug /f GOAL.pfx /p MyPassword MyFile.exe

or

signtool sign /debug /n "My Company Certificate" MyFile.exe

EDIT: still confused how do i make that A.key file?

openssl pkcs12 -export -in X.cer -inkey A.key -out GOAL.pfx -certfile ??.cer

or

openssl pkcs12 -export -in X.cer -inkey A.key -out GOAL.pfx

The -in specifies input certificate to embed in output file (code sign official file)

The -inkey specifies the key file you've generated using OpenSSL (??????? how ?????)

The -out tells the openssl your desired name for output file (PFX file )

The -certfile is used to specify additional certificates to add to the output pfx file (it could be ignored) optional.

Possible duplicate of [Adding an intermediate certificates to a pkcs12 file](http://stackoverflow.com/questions/22618108/adding-an-intermediate-certificates-to-a-pkcs12-file). The answer provided at the question takes you through all the steps to create a PFX file from a signed certificate, private key and intermediate certificates. — jww, Jun 25 '14 at 08:05
Sorry, but the link you shared does not explain how to get that A.key file? its not duplicate question being asked here. After purchase of Code sign i only have one file called CER now from that i need to prepare all the rest which is confusing and all the answers are not exactly explained. — , Jun 25 '14 at 08:32
You should have the key. You use it to generate the request. What platform are you working on? Is this for the Windows Store ecosystem (Microsoft keeps your private key, which means its already compromised)? — jww, Jun 25 '14 at 08:39
Linux and Mac platform. I have no idea KEY file i ever used for purchasing CODE Signing. I have never had KEY File to upload for code sign. I only have one file call CER which in my example i named it as X.cer beside that i do not have A.key and B.crt — , Jun 25 '14 at 08:41
PFX file i am preparing is for Windows 7. I normally use Linux and Mac daily basis. — , Jun 25 '14 at 08:42
See my answer, when i do that i am getting : "No certificate matches private key " — , Jun 25 '14 at 09:06
Comodo's software certificate process seems to generate the certificates without a key file. They must be in the browser cache or key store of the operating system. — Jason Harrison, Sep 02 '14 at 00:12

score 0 · Accepted Answer · 2014-06-25T10:59:49.550

NOTE: Many experts believes and ignores completely that "YOU DO NOT HAVE KEY FILE", please note that it normal, many Vendors do not ask for KEY files they make themselves all and provides PFX or CER files only. As a result it becomes confusing,like my case.

1) To create A.key

$ openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key
Generating a 2048 bit RSA private key
...............+++
....................+++
writing new private key to 'privateKey.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:BE
State or Province Name (full name) [Some-State]:Oost-Vlanderen
Locality Name (eg, city) []:Dendermonde
Organization Name (eg, company) [Internet Widgits Pty Ltd]:TEST
Organizational Unit Name (eg, section) []:IT
Common Name (e.g. server FQDN or YOUR name) []:NAME of DEVLOPER
Email Address []:email@domain.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

$ ls
CSR.csr     privateKey.key

2) To have the B.crt just rename the X.cer

3) finally apply the

openssl pkcs12 -export -in X.cer -inkey A.key -out GOAL.pfx

EDIT: Finally its done, i do not have KEY file yet. Vendor given me PFX file

C:\Program Files (x86)\Windows Kits\8.0\bin\x86>signtool.exe sign /debug /f C:\Users\sun\Downloads\s.pfx /p 1234password C:\Users\sun\Downloads\IeAddOnDemo\IeAddOnDemo\bin\Debug\IeAddOnDemo.dll

The following certificates were considered:
    Issued to: xxxxN.V./S.A.
    Issued by: GlobalSign CodeSigning CA - SHA256 - G2
    Expires:   Wed Apr 08 18:13:59 2015
    SHA1 hash: xxxxx

    Issued to: GlobalSign CodeSigning CA - SHA256 - G2
    Issued by: GlobalSign
    Expires:   Fri Aug 02 12:00:00 2019
    SHA1 hash: xxxxxx

After EKU filter, 2 certs were left.
After expiry filter, 2 certs were left.
After Private Key filter, 1 certs were left.
The following certificate was selected:
    Issued to: xxxN.V./S.A.
    Issued by: GlobalSign CodeSigning CA - SHA256 - G2
    Expires:   Wed Apr 08 18:13:59 2015
    SHA1 hash: xxx


The following additional certificates will be attached:
    Issued to: GlobalSign CodeSigning CA - SHA256 - G2
    Issued by: GlobalSign
    Expires:   Fri Aug 02 12:00:00 2019
    SHA1 hash: xxxx

Done Adding Additional Store
Successfully signed: C:\Users\sun\Downloads\IeAddOnDemo\IeAddOnDemo\bin\Debug\IeAddOnDemo.dll

Number of files successfully Signed: 1
Number of warnings: 0
Number of errors: 0

... But the signed certificate you got back from the CA won't work with the key you just generated. You can't just generate a private key for any arbitrary public key or certificate you are using. — jww, Jun 25 '14 at 09:11
In such case what can i do? Cause i never had a KEY nor i was asked to give them a KEY. They simply sent me the Certificate which is only a CER file. — , Jun 25 '14 at 09:25
To resolve this case. I have re-issued the CERTIFICATE request, cause its invalid from the certificate issuer. There i have requested to send me a PFX file format. They are working on it. Please note that many vendors do not take KEY files from us, they generate themself all. — , Jun 25 '14 at 10:02
@jwww: please see my VERBOSE answer finally its working. I was looking answer like i did with verbose mode. — , Jun 25 '14 at 11:00
I guess I don't quite understand what you have or what you are trying to do. Its not terribly difficult to create a PFX file from a private key and certificates. Its also not difficult to extract a private key from a PFX file. My apologies for not understanding your needs. — jww, Jun 25 '14 at 11:05
"many Vendors do not ask for KEY files ..." - they *SHOULD NOT*. Your private key *is* your private key. All the signer needs is the public key or a signing request. — jww, Jun 25 '14 at 11:07
"they make themselves all and provides PFX or CER files only..." - if someone else created your private key, then it means your private key has already been compromised. — jww, Jun 25 '14 at 11:07
OK - but i prefer the method VENDOR gives PFX file only, thats the best, no confusion. it just simply works. — , Jun 25 '14 at 11:09

How do i create the key and crt file from given code signing file cer only?

1 Answers1