Java Requires Chilkat v11.0.0+

Get Certificates from .p12 / .pfx

See more PFX/P12 Examples

A PKCS12 (.p12 / .pfx) is a container for holding a certificate, its private key, and the certs in the chain of authentication up to and possibly including the root CA cert. A .p12 is not required to contain certain things. It will contain whatever the creator of the .p12 decided to include. It's possible to contain just a private key, just a cert, many certs without private keys, or many certs with many private keys. Usually, a .p12 contains one certificate, its associated private key, and certificates in the chain of authentication. Chilkat2 Java

import com.chilkatsoft.chilkat2.Cert;
import com.chilkatsoft.chilkat2.ChilkatException;
import com.chilkatsoft.chilkat2.Pfx;

public class ChilkatExample {

    public static void main(String[] args) {
        Pfx pfx = new Pfx();

        try {
            pfx.loadPfxFile("qa_data/pfx/test.pfx", "pfx_password");
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        // Iterate over the certs contained in the PFX
        Cert cert = new Cert();
        int numCerts = pfx.getNumCerts();
        int i = 0;
        while (i < numCerts) {
            pfx.certAt(i, cert);

            System.out.println("--- " + i + " ---");
            System.out.println(cert.getSubjectDN());
            // Is this a root cert, or self-signed?
            System.out.println("Root: " + cert.getIsRoot());
            System.out.println("Self-Signed: " + cert.getSelfSigned());

            // If this certificate is not the root (self-signed), then get the issuer.
            // If the issuing certificate is contained in the PFX, then it will be found here..
            if (!cert.getSelfSigned()) {
                Cert issuer = cert.findIssuer();
                if (issuer == null) {
                    System.out.println("Issuer not found.");
                } else {
                    System.out.println("Issuer: " + issuer.getSubjectDN());
                    issuer.close();
                }
            }

            i = i + 1;
        }

        // Usually, the user certificate is at index 0, its issuer is at index 1, etc. until we get to the root certificate.
    }
}