OpenSSL cannot convert PKCS12 exported from Cisco ASA 55xx

Solution 1:

This is strange. I have the same problem and found this question to have no answer. I then did more searching and found a yaleman.org post that says they found the answer and linked to this very question. Yet there was no answer here. Retroactively fixing that, full props to yaleman.

Long and short: You need to convert the pfx from Base64 to openssl's binary format.

$ openssl enc -base64 -d -in certfile.pfx -out converted.pfx

Then you can convert it to a PEM and get the key or cert separately.

$ openssl pkcs12 -in converted.pfx -out bundle.pem -clcerts -nodes

Solution 2:

If you have trouble with the decode, check your file and delete any blank lines in it. Our ASA was saving them with leading blanks and openssl doesn't like that.