Export public key from p12 file

Question

I have a p12 file exported from a Firefox browser. And now I want to extract the public key to give them to friends (not the whole p12 file).

I used OpenSSL-Windows32 and converted p12 to pem, after which I tried to export the public key from pem.

Here is the syntax I used:

openssl pkcs12 -in pgp.p12 -clcerts -out pgp.pem openssl pkey -in pgp.pem -pubout -out pub.pem 

Now I have pub.pem with contains something like this:

 -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9...... -----END PUBLIC KEY----- 

Are you exporting the pub file correctly? And can I give pgp.pem to my friends without risk?

Answer 1

Based on your file names, it looks like you might have a PGP key. It is right?

They can work with PGP, but for a non-PGP key, I would extract the public key using the following commands:

 openssl pkcs12 -in mykeystore.p12 -clcerts -nokeys -out mycert.pem openssl x509 -pubkey -in mycert.pem -noout > mypubkey.pem 

The -nokeys option prevents private keys from being displayed.

Public keys and certificates can usually be issued without problems. You obviously don't want to give out the private key, but the public parts are fine.

One point though ... in most cases you want to issue a certificate, not just the key itself. The certificate (obtained from the first command above) contains the public key and contains the signature of the person who associates this key with a specific identifier.

For example, Verisign will sign a certificate containing your public key. You can then pass this certificate on to your friends, and since they trust Verisign, they know that this is really your public key.

If you simply send your public key to your friends, there is a chance that someone might intercept the public key and put your own key in the email before it reaches your friends. They mistakenly thought that they have a key when they have someone else. If they try to encrypt with him, that person will be able to decrypt everything.

So, if you are not using a certificate, at least make sure that your friends have received the correct key by confirming the key hash by phone or in person.