How to inspect a PKCS#12 file using OpenSSL

PKCS#12 archives often arrive as password-protected .pfx or .p12 files from certificate portals, appliances, Windows stores, and vendor handoffs. The archive can contain certificates and a private key, so inspecting it before import helps confirm what is inside without printing the private key to the terminal.

OpenSSL parses an existing archive with the pkcs12 subcommand unless -export is supplied. The -info -noout inspection path verifies the archive password and integrity MAC, then prints container details such as certificate bags, encrypted data, and shrouded key bags while suppressing credential output.

A structure check does not prove that the certificate is valid for a hostname, trusted by clients, or matched to the private key expected by a service. Extract only certificate material when field-level review is needed, keep password files out of shell history, and delete temporary inspection copies after the archive has been identified.

1. Place the PKCS#12 archive and password file in a private working directory.

   A .pfx or .p12 archive commonly contains the private key. Keep the archive and password file readable only by the account doing the inspection, and replace server.p12 and pfx.pass with local filenames.

2. Inspect the archive structure without printing certificate or key material.

   $ openssl pkcs12 -in server.p12 -passin file:pfx.pass -info -noout
   MAC: sha256, Iteration 2048
   MAC length: 32, salt length: 8
   PKCS7 Encrypted data: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA256
   Certificate bag
   PKCS7 Data
   Shrouded Keybag: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA256

   Certificate bag shows certificate material. Shrouded Keybag shows an encrypted private key is present. Older archives may show different encryption names; use -legacy only when OpenSSL cannot load a legacy archive with the default providers.

3. Identify a wrong password or unreadable archive by the MAC verification error.

   $ openssl pkcs12 -in server.p12 -passin file:wrong.pass -info -noout
   MAC: sha256, Iteration 2048
   MAC length: 32, salt length: 8
   Mac verify error: invalid password?

   Do not use -nomacver to bypass this check for routine inspection. A failed MAC check means the password, archive, or archive integrity needs to be resolved before import.

4. Extract only the leaf certificate when subject, issuer, date, or SAN fields need review.

   $ openssl pkcs12 -in server.p12 -passin file:pfx.pass -clcerts -nokeys -out pfx-leaf.crt.pem

   -clcerts -nokeys writes the certificate associated with the key and skips private-key output.

5. Inspect the extracted certificate fields.

   $ openssl x509 -in pfx-leaf.crt.pem -noout -subject -issuer -dates -ext subjectAltName
   subject=C=US, O=Example Corp, CN=server.example.com
   issuer=C=US, O=Example Corp, CN=server.example.com
   notBefore=Jun 30 07:52:25 2026 GMT
   notAfter=Aug  1 07:52:25 2027 GMT
   X509v3 Subject Alternative Name:
       DNS:server.example.com, DNS:www.example.com

   Use certificate field checks to confirm identity and dates. Use a chain validation or key-match check before treating the archive as ready for deployment.
   Related: How to view certificate details using OpenSSL
   Related: How to verify a certificate chain using OpenSSL
   Related: How to check whether a certificate matches a private key using OpenSSL

6. Remove temporary inspection files after recording the fields needed for the import decision.

   $ rm -f pfx-leaf.crt.pem pfx.pass wrong.pass server.p12

   Delete only staged inspection copies. Keep the original archive in approved secret storage when it is still needed for import or audit records.