How to extract certificates from a PKCS#7 file using OpenSSL

Certificate bundles often arrive from CA portals, Windows exports, vendor consoles, and appliances as PKCS#7 or P7B containers instead of separate PEM files. Extracting the certificates with OpenSSL turns that certificate-only bundle into text blocks that Linux services, reverse proxies, and chain checks can read.

The openssl pkcs7 command reads the container and -print_certs emits the certificates inside it. Binary .p7b files usually need -inform DER, while text files that start with a —–BEGIN PKCS7—– line use -inform PEM. Adding -quiet writes clean PEM certificate blocks without the subject and issuer summary lines.

PKCS#7 carries certificates, not private keys. Extraction proves that OpenSSL can parse the bundle and write certificate material, but it does not prove hostname coverage, certificate trust, revocation status, private-key match, or final service deployment. Check the extracted leaf and issuer order before installing the bundle into a TLS service.

1. Save the received PKCS#7 file as bundle.p7b in the working directory.

   Use the original CA, Windows, vendor, or appliance export. Do not paste a binary .p7b file into a text editor before extraction.

2. List the certificates inside the DER bundle before writing the PEM output.

   $ openssl pkcs7 -inform DER -in bundle.p7b -print_certs -noout
   subject=C=US, O=Example Corp, CN=server.example.com
   issuer=C=US, O=Example Corp, CN=Example Root CA
   
   subject=C=US, O=Example Corp, CN=Example Root CA
   issuer=C=US, O=Example Corp, CN=Example Root CA

   Use -inform PEM instead of -inform DER when the input file starts with —–BEGIN PKCS7—–.

3. Extract the certificates to a clean PEM bundle.

   $ openssl pkcs7 -inform DER -in bundle.p7b -print_certs -quiet -out extracted-certs.pem

   OpenSSL prints no output when the extraction succeeds. The -quiet option keeps extracted-certs.pem limited to certificate blocks.

4. Inspect the first extracted certificate.

   $ openssl x509 -in extracted-certs.pem -noout -subject -issuer -dates
   subject=C=US, O=Example Corp, CN=server.example.com
   issuer=C=US, O=Example Corp, CN=Example Root CA
   notBefore=Jun 30 07:58:32 2026 GMT
   notAfter=Aug  1 07:58:32 2027 GMT

   The first certificate should be the leaf certificate expected by the target service. Validate the full trust path before deployment when the service requires an install-ready chain.
   Related: How to view certificate details using OpenSSL
   Related: How to verify a certificate chain using OpenSSL