Can I combine multiple certs into one without the private key?

Question

I need to have up to date cert trust stores in many devices, so I would like to be able to combine them into on cert that I can then just push that one file. I only want to bundle the public keys of the many CA's but I do not want to add the private file because I want a cert that I push to all of my devices. I was thinking that this feature was called a chain but openssl will not take the command without a private file. Can this be done? I have tried several different things and I have looked at many threads here but I don't know what I am doing.

Edit

The command that I was trying to use was:

openssl -export -pkcs12 -out output.pem -cafile intermediate.pem

Edit

I tried "openssl crl2pkcs7 -certfile bundle.pem -out p7.pem" but it produced an error:

openssl crl2pkcs7 -certfile bundle.pem -out p7.pem
unable to load CRL
9460:error:0906D06C:PEM routines:PEM_read_bio:no start line:.\crypto\pem\pem_lib.c:701:Expecting: X509 CRL

I also tried:

openssl pkcs7 -in bundle.pem -out p7.pem
unable to load PKCS7 object
3676:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:.\crypto\asn1\tasn_dec.c:1201:
3676:error:0D06C03A:asn1 encoding routines:ASN1_D2I_EX_PRIMITIVE:nested asn1 error:.\crypto\asn1\tasn_dec.c:765:
3676:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:.\crypto\asn1\tasn_dec.c:697:Field=type, Type=PKCS7
3676:error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib:.\crypto\pem\pem_oth.c:83:

Answer 1

If you already have the certificates, you could simply concatenate them:

cat cert1.pem cert2.pem > bundle.pem

However, it really depends on the format which each trust store expects. So for instance, the Public Key Cryptography Standards describes several standards which could be used to distribute certificates, keys etc. One of them is PKCS#7, which is often used to bundle a set of certificates without the private key. You need to probably look at how each device implements the trust store because they may all expect different formats.