Different between -cacerts and -clcerts when using openssl

Question

I'm trying to understand the difference between these two commands:

openssl pkcs12 -in my-certificate.pfx -out my-certificate.pem -cacerts

openssl pkcs12 -in my-certificate.pfx -out my-certificate.pem -clcerts

My understanding is that -cacert will just contain the root certificate while -clcerts will include the complete certificate chain. Is this correct?

I want to be able to extract the complete certificate chain from the pfx file, and Not sure if this is the right way to do it.

Thanks.

Answer 1

according to the documentation,

-clcerts only output client certificates (not CA certificates).

-cacerts only output CA certificates (not client certificates).

https://www.openssl.org/docs/man1.0.2/man1/pkcs12.html

Answer 2

To extract complete certificate chain from pfx file use:

openssl pkcs12 -in my-certificate.pfx -chain -nokeys -out my-certificate.pem