P12 vs PFX

[Stefan Vatev]

Hi guys,
I've got some simple questions. Are *.pfx and *.p12 files
interchangeable? AFAIK the .pfx is something like a not
fully implemented subset of .p12. Are there applications
that accept only one of the two formats? My experiments
show that changing the postfix .p12 to .pfx or the opposite
does the job.

10x in advance




--------------------------------------
Безплатната поща в mail.bg вече е 1GB!


______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
User Support Mailing List                    [hidden email]
Automated List Manager                           [hidden email]

[Dr. Stephen Henson]

On Mon, Jul 04, 2005, [hidden email] wrote:

>
> Hi guys,
> I've got some simple questions. Are *.pfx and *.p12 files
> interchangeable? AFAIK the .pfx is something like a not
> fully implemented subset of .p12. Are there applications
> that accept only one of the two formats? My experiments
> show that changing the postfix .p12 to .pfx or the opposite
> does the job.
>
> 10x in advance
>

Short answer: nowadays the terms "PFX" and "PKCS12" can be used interchangably
and files with either extension are equivalent. Both conform to the PKCS#12
specification.

Longer answer: historically a standard was developed to be a format which
could encode and encrypt certificates and private keys. That was developed by
Microsoft and was called "PFX". Netscape implemented it as well. Very little
interop testing was done and as a result all manner of peculiarities had to be
implemented to handle it properly, including two different and broken key
derivation algorithms the details of which weren't (AFAIK) ever made public.

[One of the first projects I ever did involving ASN1 and SSLeay (no OpenSSL
back then) was a working implementation of PFX (its still on my website
somewhere). After that nightmare other things seem tame in comparison]

The only browser that implemented it fully AFAIK was Netscape 4.03. Several
versions of MSIE transparently support PFX import only (it may still do).

Shortly afterwards the PKCS#12 standard was adopted instead which, while it
may have its problems, was wonderful compared to PFX.

This "original broken PFX" format has now effectively been consigned to the
dustbin of history. However Microsoft for their own reasons still use the term
"PFX files" and the extension ".pfx" whereas other people (including me)
normally use the term "PKCS#12 files".

Steve.
--
Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage
OpenSSL project core developer and freelance consultant.
Funding needed! Details on homepage.
Homepage: http://www.drh-consultancy.demon.co.uk
______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
User Support Mailing List                    [hidden email]
Automated List Manager                           [hidden email]

[PJ-7]

Hi all,

I am writing a module for apache that needs to dump client certificate
information from mod_ssl which ultimately uses OpenSSL...

Does anyone have any idea how to apply this hook?
If this is the wrong forum for this can someone suggest a mailing list?

Thanks..
Pj.
 

--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.8.9/39 - Release Date: 4/07/2005
 

______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
User Support Mailing List                    [hidden email]
Automated List Manager                           [hidden email]