Joining GoDaddy-issued .spc and .key files into a complete .pfx / .cer certificate

certificate key code-signing pfx spc
Ondrej Tucny picture Ondrej Tucny · Jan 13, 2011 · Viewed 24k times · Source

I have a GoDaddy-issued code signing certificate in a .spc file. Also, I have a private key in .key file. The code signing has been issued some 13 months ago, then it expired and was renewed with GoDaddy. During the renewal process no private key was requested and just a new .spc file was issues.

Now I'm facing the problem of joining the original private key file with the issues certificate to form a .pfx (or .cer?) file suitable for installation into the Windows certificate store.

The command I'm trying is:

openssl.exe pkcs12 -inkey my.key -in my.spc -out my.pfx -export

However, I'm getting an error message that reads “No certificate matches private key”.

I've followed this answer on SO to verify the .key file is a valid private key. However, when I try to verify that .spc is a valid certificate, I just get 

unable to load certificate 
5436:error:0906D06C:PEM routines:PEM_read_bio:no start line:.\crypto\pem\pem_lib.c:650:Expecting: TRUSTED CERTIFICATE

What's the correct way of producing an .pfx file from my inputs? I'm using OpenSSL 0.9.8k.

Answer

Ondrej Tucny picture Ondrej Tucny · Mar 24, 2011

In the end I managed to figure out a procedure that works. Here are the steps to generate a new PFX and CER code signing certificate from SPC and KEY files:

  1. Obtain your new CodeSign.spc certificate from GoDaddy.

  2. Export a PEM-formatted private key from the expired PFX:

    openssl.exe pkcs12 -in CodeSign.pfx -nocerts -out CodeSign.pem

  3. Convert the PEM-formatted private key into the PVK format:

    pvk.exe -in CodeSign.pem -topvk -strong -out CodeSign.pvk

  4. Combine the PVK and SPC into PFX:

    pvk2pfx.exe -pvk CodeSign.pvk -pi <passphrase> -spc CodeSign.spc -pfx CodeSign.pfx -po <passphrase> -f

  5. Import the resulting PFX file into Windows certificate store. Remember to make it exportable.

  6. Export it from the certificate store into the binary CER format as CodeSign.cer.
  7. Optionally delete the certificate from the Windows certificate store.

In case you are renewing your certificate periodically you can store the PVK file and skip steps (2) and (3).

UPDATE: In case you happen to have the certificate in CRT instead of SPC format, do the following to covert it into SPC:

openssl crl2pkcs7 -nocrl -certfile CodeSign.crt -outform DER -out CodeSign.spc

Sources:

The tools you will need:

  • OpenSSL
  • pvk.exe — see the download link at the bottom of that page (original location may not be accessible; in such a case see this article with a link to a mirror site or another direct download link here)
  • pvk2pfx.exe — part of Microsoft SDKs, installs with Visual Studio 2010

Related questions

SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

I'm not able to setup SSL. I've Googled and I found a few solutions but none of them worked for me. I need some help please... Here's the error I get when I attempt to restart nginx: root@s17925268:~# service …

Read More
Google Maps API Key in release build doesn't work

I'm currently developing an application for Android and I'm using Google Maps API. In developer console, I added my SHA1 certificate print, followed by my package name. Even though I put this SHA1 certificate print using keytool, I can't access …

Read More
What is the purpose of a .jks keystore?

I've been asked to create a jks keystore based on a certificate we had created. I've read a bit on the topic, but I'm still confused on a few items: Is the private key of a certificate supposed to be …

Read More