what is wrong with this pkcs12 file(pfx)

Question

I created a my private CA and form a pkcs12 certificate file for testing. I did this on my Linux box with openssl by:

1. openssl req -config /etc/openssl.cnf -subj /CN=aa1@2C/O=Ruckus Wireless, Inc./ST=CA/C=US -batch -new -nodes -key users/2C.key -out users/2C.csr
2. openssl ca -config /etc/openssl.cnf -extensions client_cert -batch -in users/2C.csr -out users/2C.crt
3. openssl pkcs12 -export -out users/2C.pfx -inkey users/2C.key -in users/2C.crt -certfile cacert.pem -passout stdin

After that, I copied the 2c.pfx to my Windows 7 machine and tried to install it, but the error message bumped out:

Invalid Public Key Security Object File: This file is invalid for use as the following:Personal Information Exchange.

What is the reason for this? Did I create a broken pfx file?

Answer 1

I also had the message

Invalid Public Key Security Object File: This file is invalid for use as the following:Personal Information Exchange.

The problem was that de p12-file was on a networkshare which was mapped as a drive. Copying the file to my real hard drive (C:) solved the problem.

Answer 2

This is somewhat obscure (I don't ever recall seeing it, but hey...). First, ensure that you are importing the certificate into the proper store. Most import errors I have encountered are due to he wrong store. I believe you need to install the certificate in the local machine's Trusted Root Certificate Authorities store (Intermediate Certificate Authorities does not work). If that's not a store problem....

Second, try this out from the Microsoft forums. Unable to Import Certificate (p12 or pfx File). (I reproduced it in case Microsoft rearranges their website. But to be clear, its someone else's solution):

secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose

By the way, I think you can check if its well formed according to Microsoft tools with the following. I don't have a Windows machine handy to test it with.

certutil -dump 2C.pfx