PKCS 12

The correct title of this article is PKCS #12. The omission of the # is due to technical restrictions.

In cryptography, PKCS #12 defines an archive file format for storing many cryptography objects as a single file. It is commonly used to bundle a private key with its X.509 certificate or to bundle all the members of a chain of trust.

PKCS #12

Filename extension	.p12, .pfx
Internet media type	application/x-pkcs12
Uniform Type Identifier (UTI)	com.rsa.pkcs-12[1]
Developed by	RSA Security
Initial release	1996 (1996)
Latest release	PKCS #12 v1.1 27 October 2012; 12 years ago (2012-10-27)
Type of format	Archive file format
Container for	X.509 public key certificates, X.509 private keys, X.509 CRLs, generic data
Extended from	Microsoft PFX file format

A PKCS #12 file may be encrypted and signed. The internal storage containers, called "SafeBags", may also be encrypted and signed. A few SafeBags are predefined to store certificates, private keys and CRLs. Another SafeBag is provided to store any other data at individual implementer's choice.^[2][3]

PKCS #12 is one of the family of standards called Public-Key Cryptography Standards (PKCS) published by RSA Laboratories.

The filename extension for PKCS #12 files is .p12 or .pfx.^[4]

These files can be created, parsed and read out with the OpenSSL pkcs12 command.^[5]

Relationship to PFX file format

PKCS #12 is the successor to Microsoft's "PFX";^[6] however, the terms "PKCS #12 file" and "PFX file" are sometimes used interchangeably.^[4][5][7]

The PFX format has been criticised for being one of the most complex cryptographic protocols.^[7]

Normal usage

The full PKCS #12 standard is very complex. It enables buckets of complex objects such as PKCS #8 structures, nested deeply. But in practice it is normally used to store just one private key and its associated certificate chain.^{[citation needed]}

PKCS #12 files are usually created using OpenSSL, which only supports a single private key from the command line interface. The Java keytool can be used to create multiple "entries" since Java 8, but that may be incompatible with many other systems.^[8] As of Java 9 (released 2017-09-21), PKCS #12 is the default keystore format.^[9][10]

A simpler, alternative format to PKCS #12 is PEM which just lists the certificates and possibly private keys as Base 64 strings in a text file.

GnuTLS's certtool may also be used to create PKCS #12 files including certificates, keys, and CA certificates via --to-p12. However, beware that for interchangeability with other software, if the sources are in PEM Base64 text, then --outder should also be used.