Programmatic way of using .pfx (pkcs12) file instead of .pem file for establishing SSL connection

2.1k views Asked by At

Until now, we are using a .pem file and we are able to establish an SSL connection (just for reference, below code):

ASSERT(true == ::SSL_CTX_use_certificate_file(
         m_Attribute.m_pContext, certificateFileName.c_str(), SSL_FILETYPE_PEM),
       "Unable to use certificate file.");

ASSERT(true == ::SSL_CTX_use_PrivateKey_file(
         m_Attribute.m_pContext, certificateFileName.c_str(), SSL_FILETYPE_PEM),
       "Unable to load private key file.");

::SSL_CTX_set_options(m_Attribute.m_pContext, g_SSLChoice[version].m_Negotiation);

// ... some more relevant code

ASSERT(true == ::SSL_set_tlsext_host_name(m_pSSL, hostName.c_str()),
       "Cannot enable server name indication for " + hostName);

{
  int result = ::SSL_connect(m_pSSL);
  ASSERT(result == 1, "Cannot build an SSL connection, error = " +
      Util::Convert::to_string(::SSL_get_error(m_pSSL, result)));
}

However now the requirement has changed and we have to use .pfx file. In OpenSSL, I couldn't find an option/function for using the same.

Have searched many threads in SO and various forums like:
Converting .PFX to .PEM programatically?
Convert a .PEM certificate to .PFX programmatically using OpenSSL
Converting pfx to pem using openssl
... and few others.

But couldn't find a way to convert .pfx to .pem programmatically in C/C++ with Linux.
Is there any readily available OpenSSL API which supports this? (e.g. for .pem we have a constant SSL_FILETYPE_PEM]

1

There are 1 answers

4
rfermi On

There's no way to use convertions with standard C99/ANSI libs. You can alternatively try to use system() or popen() to call sys function, like OpenSSL.

$ openssl pkcs12 -in cert.pfx -out cert.pem