How to Open a PFX/P12 File and Inspect Its Certificates

Open a .pfx or .p12 file in the PKIScope PFX/P12 Viewer, or run openssl pkcs12 -in bundle.p12 -info -noout in a terminal. Start with the archive metadata, then extract only the public certificate if you need to check its DNS names or expiry.

What is inside a PFX or P12 file?

Both extensions commonly identify a PKCS#12 archive. A typical TLS identity archive contains a private key, its leaf certificate and one or more intermediate CA certificates. An archive can also contain only certificates or several identities. A friendly name labels an entry, and bag attributes such as localKeyID can help associate a key with its certificate.

Treat the archive and password as credentials. Run the commands below on a machine authorized to handle the material, and enter passwords at the interactive prompts. Use the PFX-to-PEM converter if your deployment calls for separate files. Any exported private key needs the same protections as the original. If you already have separate files, use the certificate and private-key matcher to check that they belong together.

Inspect the archive with OpenSSL 3

openssl pkcs12 -in bundle.p12 -info -noout

OpenSSL reports the archive structure and algorithms. A Shrouded Keybag indicates an encrypted private-key bag. Certificate bag lines indicate certificates. -noout suppresses credential output. Reading the archive successfully tells you about its contents and integrity, while TLS identity and trust checks happen separately.

If the error names RC2-40-CBC, follow the OpenSSL 3 legacy PFX troubleshooting guide. If MAC verification fails, confirm the password and get a fresh copy from the exporter if necessary.

Extract the public certificate and check its DNS names

For a bundle containing one key and certificate, use the following commands. -nokeys keeps the extraction certificate-only.

openssl pkcs12 -in bundle.p12 -clcerts -nokeys -out leaf.pem
openssl x509 -in leaf.pem -noout -subject -issuer -dates -ext subjectAltName
openssl x509 -in leaf.pem -noout -sha256 -fingerprint
  • Subject Alternative Name (SAN). Check the DNS name the client will use, or the IP address if the client connects by IP.
  • Validity dates. Check both notBefore and notAfter against the client’s clock.
  • Issuer and SHA-256 fingerprint. Compare these with your issuance records to identify the certificate precisely.

For bundles with several identities, select the expected certificate by its bag attributes and fingerprint before inspecting it. openssl x509 reads the first certificate in the extracted PEM file. The X.509 certificate decoder can display the extensions of an individual certificate.

Check the bundled intermediates and the live endpoint

openssl pkcs12 -in bundle.p12 -cacerts -nokeys -out chain.pem

Look for the intermediates the issuer supplied. The presence of a root in the archive does not establish client trust. If the archive has no CA certificates, get the intermediate chain from the issuer when the deployment requires it. Use the certificate chain checker to inspect the public chain.

openssl s_client -connect example.com:443 -servername example.com \
  -showcerts </dev/null

Replace example.com with your server name. -showcerts shows certificates presented by the live server, which may differ from the archive. If the running application uses a Java keystore, check the configured alias and its certificate chain.

References