Solved

Using C# to extract publick key from pfx file without a password

Posted on 2016-10-18
2
309 Views
Last Modified: 2016-10-22
I want to know if it is possible, and how, to use C# to extract publick keys from pfx files without a password. I understand the password is there to protect the private key, so the public keys should be available without the password right?
0
Comment
Question by:itnifl
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 63

Accepted Solution

by:
btan earned 500 total points
ID: 41849524
You still need password as pfx is protected by password. Your can extract if it is plain pem or crt but no pfx without password.  You should be able to get a collection object containing the certs in your .pfx file by using the X509Certificate2Collection class
string certPath = <YOUR PFX FILE PATH>;
string certPass = <YOUR PASSWORD>;

// Create a collection object and populate it using the PFX file
X509Certificate2Collection collection = new X509Certificate2Collection();
collection.Import(certPath, certPass, X509KeyStorageFlags.PersistKeySet);

foreach (X509Certificate2 cert in collection)
{
    Console.WriteLine("Subject is: '{0}'", cert.Subject);
    Console.WriteLine("Issuer is:  '{0}'", cert.Issuer);

    // Import the certificates into X509Store objects
}
In .NET, the X509Certificate2 object has properties for the PublicKey and PrivateKey. But that's largely for convenience. A certificate is something you are supposed to present to someone to prove something, and by design, it's only the public portion of the public/private key pair that is ever presented to anyone. When an X509 certificate is presented to someone, .NET of course strips out the private key. Having the private key property on the certificate object is a bit of a misrepresentation, especially since, as we'll see, there's a big difference in how the public and private key are dealt with.
http://paulstovell.com/blog/x509certificate2

May be better to use openssl
•Private key: openssl pkcs12 -in yourP12File.pfx -nocerts -out privateKey.pem

•Certificates: openssl pkcs12 -in yourP12File.pfx -clcerts -nokeys -out publicCert.pem
http://anuchandy.blogspot.sg/2012/04/extracting-public-certificate-and.html
0
 
LVL 2

Author Closing Comment

by:itnifl
ID: 41855471
Find it weird that OpenSSL can do it, but not .Net.
What you tell me is the same as what I found.
0

Featured Post

Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Businesses who process credit card payments have to adhere to PCI Compliance standards. Here’s why that’s important.
Smart phones, smart watches, Bluetooth-connected devices—the IoT is all around us. In this article, we take a look at the security implications of our highly connected world.
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question