Convert KMIP Client PKCS#12 to PEM

The Securosys CyberVault KMS creates the client credential as two PKCS#12 bundles: a keystore (the client identity) and a truststore (the CA used to verify the server). However, some business applications require PEM files instead of PKCS#12 files. This guide shows how to convert the client credential files from PKCS#12 to PEM.

tip

Instead of converting the PKCS#12 files to PEM, you can re-download the client credentials from the KMS and choose "PEM" as the export format.

Convert the Keystore

Extract the client certificate and key from the keystore PKCS#12 file:

# Client certificate
openssl pkcs12 -in kmip-client-keystore.p12 -clcerts -nokeys -out kmip-client-cert.pem

# Private key, unencrypted (most applications don't support password-protected PEM files)
openssl pkcs12 -in kmip-client-keystore.p12 -nocerts -nodes -out kmip-client-key.pem

For applications that require a single PEM file for the keystore: Combine the client certificate and its private key in one PEM file.

cat kmip-client-cert.pem kmip-client-key.pem > kmip-client.pem
chmod 600 kmip-client.pem

Convert the Truststore

Extract the server CA certificate from the truststore:

openssl pkcs12 -in kmip-client-truststore.p12 -nokeys -out kmip-server.pem

Verify the Result

Confirm the certificate carries the expected KMIP identity:

openssl x509 -in kmip-client-cert.pem -noout -subject

Also, confirm the TLS path to the KMIP Server works end-to-end:

openssl s_client -connect <kmip-host>:5696 \
  -cert kmip-client-cert.pem \
  -key kmip-client-key.pem \
  -CAfile kmip-server.pem

A successful handshake dumps the server certificate, SSL verifications and session details and ends with Verify return code: 0 (ok).