# extracting key and certificate

**URL:** <https://forum.ansible.com/t/extracting-key-and-certificate/38381>\
**Category:** Ansible Project\
**Created:** [August 28, 2023, 5:25pm UTC](https://forum.ansible.com/t/extracting-key-and-certificate/38381 "2023-08-28T17:25:29Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mahesh\_Nalavade](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mahesh_nalavade/32/7935_2.png) [@Mahesh\_Nalavade](https://forum.ansible.com/u/Mahesh_Nalavade)\
**Post date:** [August 28, 2023, 5:25pm UTC](https://forum.ansible.com/t/extracting-key-and-certificate/38381/1 "2023-08-28T17:25:29Z")

</div>

Hi All,

Trying to extract the private key and certificate from pfx file format using ansible module.Can someone please provide the example.

---

<div class="post-metadata">

**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\
**Post date:** [August 28, 2023, 6:01pm UTC](https://forum.ansible.com/t/extracting-key-and-certificate/38381/2 "2023-08-28T18:01:59Z")

</div>

IIRC PFX are usually binary file that contain ‘everything’, i.e. the private key, the cert and any intermediates.  
I would try both

[https://docs.ansible.com/ansible/latest/collections/community/crypto/x509\_certificate\_info\_module.html](https://docs.ansible.com/ansible/latest/collections/community/crypto/x509_certificate_info_module.html) and

[https://docs.ansible.com/ansible/latest/collections/community/crypto/openssl\_privatekey\_info\_module.html](https://docs.ansible.com/ansible/latest/collections/community/crypto/openssl_privatekey_info_module.html)  
and see what that gets me.

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [August 28, 2023, 7:10pm UTC](https://forum.ansible.com/t/extracting-key-and-certificate/38381/3 "2023-08-28T19:10:04Z")

</div>

Hi,

> Trying to extract the private key and certificate from pfx file  
> format using ansible module.Can someone please provide the example.

PFX files are usually PKCS #12 files  
([https://en.wikipedia.org/wiki/PFX](https://en.wikipedia.org/wiki/PFX)), so community.crypto.openssl\_pkcs12  
([https://docs.ansible.com/ansible/latest/collections/community/crypto/openssl\_pkcs12\_module.html](https://docs.ansible.com/ansible/latest/collections/community/crypto/openssl_pkcs12_module.html))  
should help you.

Check out the action=parse example, it dumps the contents into a PEM  
file, and you can split that one with  
[https://docs.ansible.com/ansible/latest/collections/community/crypto/split\_pem\_filter.html](https://docs.ansible.com/ansible/latest/collections/community/crypto/split_pem_filter.html)).

Cheers,  
Felix

---

<div class="post-metadata">

**Author:** ![Mahesh\_Nalavade](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mahesh_nalavade/32/7935_2.png) [@Mahesh\_Nalavade](https://forum.ansible.com/u/Mahesh_Nalavade)\
**Post date:** [August 28, 2023, 10:05pm UTC](https://forum.ansible.com/t/extracting-key-and-certificate/38381/4 "2023-08-28T22:05:54Z")

</div>

Hi All,

I basically wanted to run the below command and create those files using ansible community.crypto module.Its not working as expected

openssl pkcs12 -in test.pfx -nocerts -nodes | sed -ne ‘/-BEGIN PRIVATE KEY-/,/-END PRIVATE KEY-/p’ \> test.key

openssl pkcs12 -in test.pfx -clcerts -nokeys | sed -ne ‘/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p’ \> test.crt

openssl pkcs12 -in test.pfx -cacerts -nokeys -chain | sed -ne ‘/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p’ \> cacerts.crt

ansible code:

---

<div class="post-metadata">

**Author:** ![Mahesh\_Nalavade](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mahesh_nalavade/32/7935_2.png) [@Mahesh\_Nalavade](https://forum.ansible.com/u/Mahesh_Nalavade)\
**Post date:** [August 29, 2023, 6:30pm UTC](https://forum.ansible.com/t/extracting-key-and-certificate/38381/5 "2023-08-29T18:30:45Z")

</div>

Hi All,

Anyone has done this before.

---

<div class="post-metadata">

**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\
**Post date:** [August 29, 2023, 7:11pm UTC](https://forum.ansible.com/t/extracting-key-and-certificate/38381/6 "2023-08-29T19:11:39Z")

</div>

This is your chance to become that person!  
You did start already, please let us know your findings 🙂