Extract Public/Private Keys and Certs from PFX into String Variables

Demonstrates how to export certificates and public/private keys from a PFX file into in-memory strings.

Download Chilkat Python Library

import sys
import chilkat


certStore = chilkat.CkCertStore()

#  Load the PFX file into a certificate store object

password = "*myPassword2*"
success = certStore.LoadPfxFile("chilkat.pfx",password)
if (success != True):
    print certStore.lastErrorText()
    sys.exit()

numCerts = certStore.get_NumCertificates()

#  Loop over each certificate in the PFX.

for i in range(0,numCerts):

    cert = certStore.GetCertificate(i)

    print cert.subjectDN()
    print "---"

    encodedCert = cert.getEncoded()

    #  This string may now be stored in a relational database string field.
    #  To re-create the cert, do this:
    cert2 = chilkat.CkCert()
    cert2.SetFromEncoded(encodedCert)

    #  Does this cert have a private key?
    if (cert.HasPrivateKey() == True):

        #  Get the private key.

        pvkey = cert.ExportPrivateKey()

        #  The private key can be exported into
        #  a string in PKCS8, RSA PEM, or XML format:

        pemPvKey = pvkey.getRsaPem()
        pkcs8PvKey = pvkey.getPkcs8Pem()
        xmlPvKey = pvkey.getXml()

        print pemPvKey
        print pkcs8PvKey
        print xmlPvKey

        #  Any of these formatted strings may
        #  be stored in a relational database field.
        #  to restore, call LoadPem or LoadXml
        #  LoadPem accepts either RSA PEM or
        #  PKCS8 PEM:
        pvKey2 = chilkat.CkPrivateKey()

        pvKey2.LoadPem(pemPvKey)
        pvKey2.LoadPem(pkcs8PvKey)
        pvKey2.LoadXml(xmlPvKey)

    #  Now for the public key:

    pubkey = cert.ExportPublicKey()

    #  It can be exported to a string as OpenSSL PEM
    #  or XML:

    pubKeyPem = pubkey.getOpenSslPem()
    pubKeyXml = pubkey.getXml()

    print pubKeyPem
    print pubKeyXml

    #  To re-load a PublicKey object, call LoadXml
    #  or LoadOpenSslPem:
    pubKey2 = chilkat.CkPublicKey()

    pubKey2.LoadOpenSslPem(pubKeyPem)
    pubKey2.LoadXml(pubKeyXml)
    fname = "pubkey" + str(i) + "_openSsl.der"
    pubkey.SaveOpenSslDerFile(fname)

#  The Chilkat Certificate, Certificate Store, Private Key,
#  Public Key, and Key Container classes / objects are freeware.

#  They are used by and included with the Chilkat Email,
#  Crypt, S/MIME, and other commercial Chilkat components.