What order do the certificates and keys appear in the output file?
A. They appear in the order they appear in the input file. You can dump just user certificates or CA certificates with the clcerts and cacerts options respectively. Q. I’ve outputed a PKCS#12 file to a PEM file, created a new PKCS#12 file from the PEM file and Netscape or MSIE wont import them. A. Other than the MSIE and NS specific reasons this may be because the prior to version 0.53 the pkcs12 program was a bit naive about matching private keys and certificates. In the input file it takes the first certificate it finds and uses this as the user certificate. This is sometimes incompatible with the output format (see above). The easiest way to do this is to output just client certificates then CA certificates, as follows: pkcs12 -in my.p12 -clcerts -out cl.pem pkcs12 -in my.p12 -cacerts -nokeys -out ca.pem pkcs12 -in cl.pem -certsfile ca.pem -export -name “MYNAME” -out new.p12 From version 0.53 this should not happen any more: the pkcs12 program will automatically work out the right c
