Migrating SSL Cert from IIS to Apache - page 2

Author: Steven Neiland
Published:

Warning: This blog entry was written two or more years ago. Therefore, it may contain broken links, out-dated or misleading content, or information that is just plain wrong. Please read on with caution.

Step 2: Import the ssl cert to apache

  1. Open openssl.exe in the "apache/bin/" directory
  2. Export the client certificate file from the pfx file using this command
    //change mysite to whatever you named your pfx file from step 1 above
    openssl> pkcs12 -in mysite.pfx -clcerts -nokeys -out mysite.crt
  3. Export the DigiCert intermediate certificate file (DigiCertCA.crt) from the pfx file using this command
    //change mysite to whatever you named your pfx file from step 1 above
    openssl> pkcs12 -in mysite.pfx -cacerts -nokeys -out DigiCertCA.crt
  4. Export the private key file from the pfx file using the following command
    //change mysite to whatever you named your pfx file from step 1 above
    openssl> pkcs12 -in mysite.pfx -nocerts -out mysite.key
  5. Remove the passphrase from the private key so Apache won't prompt you for your passphase when it starts
    openssl> rsa -in mysite.key -out mysite.key

Alternative Method: For Info only,You can skip this

Alternatively you can write a text file from which to extract the key

openssl> pkcs12 -in mypfxfile.pfx -out outputfile.txt -nodes

The above command would have created a text file named outputfile.txt. Open this file with a text editor and you will see the private key listed first:

-----BEGIN RSA PRIVATE KEY-----
(Block of Random Text)
-----END RSA PRIVATE KEY-----

Copy and paste all of the private key, including the BEGIN and END tags to a new text file and save it as your_domain_name.key

-----BEGIN CERTIFICATE-----
(Block of Random Text)
-----END CERTIFICATE-----

Copy and paste all of the private key, including the BEGIN and END tags to a new text file and save it as your_domain_name.cert

1 2 3 4

Reader Comments

NS's Gravatar
NS
Wednesday, November 7, 2012 at 3:40:12 AM Coordinated Universal Time

Thanks for this, had to put the IIS cert on the apache reverse proxy...followed your steps, perfect.
Thanks a lot.

Carlo Idini's Gravatar
Carlo Idini
Monday, February 3, 2014 at 11:53:26 AM Coordinated Universal Time

Thank you!
It has worked perfectly for me.
I was looking for a solution from hours,
very crear and useful!
Carlo

  • Please keep comments on-topic.
  • Please do not post unrelated questions or large chunks of code.
  • Please do not engage in flaming/abusive behaviour.
  • Comments that contain advertisments or appear to be created for the purpose of link building, will not be published.

Archives Blog Listing