Pfx Lianja Reference Documentation
Pfx
Current Version: 11.5.0
Chilkat.Pfx
Load password-protected certificate and private-key bundles from files,
memory, encoded strings,
Enumerate contained certificates, private keys, and certificate chains to
locate the identity or trust material needed by the application.
Add certificates and private keys to create a PKCS#12 bundle for TLS,
S/MIME, signing, authentication, or platform import workflows.
Read and manage PKCS#12 safe-bag attributes such as friendly names or
local key identifiers when interoperability requires them.
Export PFX content as binary data, encoded text, files, PEM, or Java
KeyStore format depending on the target system.
Import certificates and private keys into Windows certificate stores or
macOS/iOS keychains when platform-backed access is required.
For an extended overview, see
Pfx Class Overview.
Load, inspect, build, export, convert, and import PFX / PKCS#12 containers.
Chilkat.Pfx is the Chilkat class for working with
PFX / PKCS#12 containers, which commonly hold certificates together with
their associated private keys and certificate chains. It can load
certificate/private-key bundles from files, memory, encoded data,
BinData, or PEM; add certificates and private keys; inspect
contained certificates and keys; manage safe-bag attributes; export to PFX,
PEM, encoded strings, binary data, files, or Java KeyStore format; and import
contents into Windows or macOS/iOS key stores.
Load PFX / PKCS#12 data
BinData, or PEM input.
Inspect certificates and keys
Build PFX containers
Safe-bag attributes
Export and convert
Import to key stores
Pfx when certificate material includes private keys packaged
in a PKCS#12 container. Load the PFX with its password, inspect or retrieve
the needed certificate and private key, then export, convert, or import the
contents into the format or platform store required by the application. Use
Chilkat.Cert and PrivateKey when working directly
with individual certificate or key objects.
Object Creation
loObject = createobject("CkPfx")
Properties
AlgorithmId
Gets or sets the password-based encryption scheme used for PKCS#8 shrouded private-key bags when writing a PFX. After a PFX is loaded, this property reports the scheme found for the loaded shrouded key bag.
The default is pbeWithSHAAnd3_KeyTripleDES_CBC for backward compatibility. Set this property to pbes2 to use the cipher and PBKDF2 HMAC choices specified by Pbes2CryptAlg and Pbes2HmacAlg.
pbes2 with AES when every target platform supports it.DebugLogFilePath
If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. This logging helps identify the context and history of Chilkat calls leading up to any crash or hang, aiding in debugging.
Enabling the VerboseLogging property provides more detailed information. This property is mainly used for debugging rare instances where a Chilkat method call causes a hang or crash, which should generally not happen.
Possible causes of hangs include:
- A timeout property set to 0, indicating an infinite timeout.
- A hang occurring within an event callback in the application code.
- An internal bug in the Chilkat code causing the hang.
LastErrorHtml
Provides HTML-formatted information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.
topLastErrorText
Provides plain text information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.
LastErrorXml
Provides XML-formatted information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.
topLastMethodSuccess
Indicates the success or failure of the most recent method call: .T. means success, .F. means failure. This property remains unchanged by property setters or getters. This method is present to address challenges in checking for null or Nothing returns in certain programming languages. Note: This property does not apply to methods that return integer values or to boolean-returning methods where the boolean does not indicate success or failure.
NumCerts
Returns the number of certificates currently contained in this PFX object. This count includes end-entity certificates and any available intermediate or root CA certificates.
Certificate indexes range from 0 through NumCerts - 1 for use with CertAt.
i has no positional relationship to private-key index i. In particular, CertAt(i) must not be assumed to return the certificate for PrivateKeyAt(i).localKeyId to associate a private key with its certificate when that attribute is present.NumPrivateKeys
Returns the number of private keys currently contained in this PFX object.
Private-key indexes range from 0 through NumPrivateKeys - 1 for use with PrivateKeyAt.
i has no positional relationship to certificate index i. A PFX commonly has more certificates than private keys because intermediate and root CA certificates are also included.localKeyId, retrieve it with GetSafeBagAttr and pass the value to CertByLocalKeyId. Do not pair a key and certificate by using the same index.Pbes2CryptAlg
Gets or sets the content-encryption cipher used when AlgorithmId is pbes2. After loading a PBES2-protected PFX, this property reports the cipher used by the loaded shrouded key bag.
| Value | Cipher |
|---|---|
aes256-cbc | AES-256 in CBC mode; the default for new PBES2 output. |
aes192-cbc | AES-192 in CBC mode. |
aes128-cbc | AES-128 in CBC mode. |
3des-cbc | Triple DES in CBC mode for compatibility. |
Pbes2HmacAlg chooses the HMAC-based PBKDF2 pseudorandom function used to derive the encryption key from the password.Pbes2HmacAlg
Gets or sets the HMAC algorithm used by PBKDF2 when AlgorithmId is pbes2. After loading a PBES2-protected PFX, this property reports the HMAC choice found in the loaded shrouded key bag.
hmacWithSha256— default for new PBES2 output.hmacWithSha384hmacWithSha512hmacWithSha1— primarily for compatibility with older consumers.
UncommonOptions
Provides specialized compatibility options for unusual PFX interoperability requirements. The default is an empty string, which is appropriate for normal use. Multiple options are separated by commas.
| Option | Effect |
|---|---|
LegacyOrder | Writes internal PKCS#12 ContentInfo objects in the ordering traditionally used by older Chilkat versions. |
NoTruncatePfxPassword64 | Prevents Chilkat's default compatibility behavior of truncating an extremely long PFX password to 64 characters. |
VerboseLogging
If set to .T., then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. The default value is .F.. Verbose logging should only be used for debugging. The potentially large quantity of logged information may adversely affect peformance.
Version
Methods
AddCert
Adds cert to this PFX as an identity. The certificate must have an associated private key that Chilkat can obtain and copy. This requirement applies whether includeChain is .T. or .F.; AddCert does not provide a certificate-only mode.
includeChain controls only whether Chilkat also attempts to add the certificate chain:
| Certificate/private-key state | includeChain |
Result |
|---|---|---|
| No private key | .F. or .T. |
Fails. A certificate cannot be added by this method without its private key. |
| Private key exists but cannot be obtained or exported | .F. or .T. |
Fails. Chilkat does not fall back to adding the certificate without the key. |
| Usable private key | .F. |
Adds the private key and cert only. Intermediate and root certificates are not added. |
| Usable private key; complete chain locatable | .T. |
Adds the private key, cert, and the locatable intermediate and root certificates. |
| Usable private key; chain incomplete | .T. |
Succeeds with a partial chain. Missing intermediate or root certificates do not cause failure. |
includeChain is .T., Chilkat searches the certificates already associated with cert and certificates made available for chain building, principally through UseCertVault. Each intermediate or root certificate is included when it can be located. The chain does not need to terminate at a root, and trust is not evaluated by this operation.cert. After this method returns, modifying, reloading, or destroying the source Cert does not affect the material already stored in the PFX, and later changes to the PFX do not affect the source object..F. but certificates already merged remain in the object. Treat failure as a possible partial modification. A missing or unobtainable private key is rejected before this merge begins.localKeyId, Chilkat generates one and assigns the same value to the key's primary certificate. This identifier associates the key and leaf certificate without relying on collection indexes. Intermediate and root CA certificates may be shared across multiple identities and are not paired by position.Returns .T. for success, .F. for failure.
AddPrivateKey
Adds privKey and the certificate chain in certChain to this PFX object. The chain must contain at least one certificate. The certificate at index 0 is treated as the end-entity certificate associated with privKey; the remaining entries are additional certificates to include with the identity. The chain does not need to contain a root certificate and may consist only of the end-entity certificate.
privKey mathematically matches the public key in the certificate at index 0. The association is positional. A mismatch is not rejected and can produce a PFX identity that later fails during signing, decryption, or client authentication.PrivateKey or CertChain after this method returns does not affect the PFX.localKeyId, Chilkat generates one. The same identifier is assigned to the certificate at index 0, linking that certificate to the key. Other safe-bag attributes are not generated automatically..F. after leaving some certificates in the PFX.Returns .T. for success, .F. for failure.
CertAt
Copies the certificate at the zero-based index index into cert. The first certificate is at index 0; valid indexes are less than NumCerts.
On success, cert is replaced with an independent, detached copy of the selected certificate. The method does not merge with or append to any certificate already held by cert. The returned copy does not remain linked to the PFX: changing either object later does not affect the other, and the copied certificate remains usable even if the PFX is subsequently modified or destroyed.
index is out of range or the certificate cannot be returned, the method returns .F. without modifying cert. When reusing a Cert object in a loop, always use its contents only after this method returns .T.; otherwise cert may still contain the certificate from an earlier successful call.CertAt(i) is not necessarily the certificate associated with PrivateKeyAt(i). To associate a key with its certificate, obtain the key's localKeyId with GetSafeBagAttr and use CertByLocalKeyId.Returns .T. for success, .F. for failure.
CertByLocalKeyId
Searches for a certificate whose certificate-bag localKeyId attribute matches localKeyId and copies it into cert. encoding names the binary representation used for localKeyId, such as decimal, base64, or hex.
On success, cert is replaced with the matching certificate. The method does not merge with any certificate already held by cert.
encoding is invalid, localKeyId cannot be decoded, or no matching certificate is found, the method returns .F. without modifying cert. Always use cert only after a .T. return, because a reused destination may still contain a certificate from an earlier call.i, call GetSafeBagAttr with localKeyId = .T., encoding = i, and cert = localKeyId. That method returns the identifier in decimal representation, so pass the returned value as localKeyId and decimal as encoding here.CertAt(i) is not the certificate for PrivateKeyAt(i) unless that happens coincidentally.Returns .T. for success, .F. for failure.
GetLastJsonData
Replaces the entire contents of json with structured JSON information from the most recent operation. The data is copied as a complete replacement; it is never merged with members already present in json.
The exact members depend on the preceding method. After loading a PFX, the JSON may describe authenticated-safe content, safe bags, encryption information, and bag attributes. If no JSON data is available, json is cleared to an empty JSON object.
json are never preserved by this call. Reusing a JsonObject is safe without clearing it first, but do not expect older members to remain.LastErrorText.Returns .T. for success, .F. for failure.
GetSafeBagAttr
Reads a recognized safe-bag attribute from a private key or certificate contained in this PFX. forPrivateKey is .T. for a private key and .F. for a certificate. index is the zero-based index within the selected collection. attrName is the attribute name and is matched case-insensitively.
| Logical attribute | Accepted attrName names | Read behavior |
|---|---|---|
| Friendly name | friendlyName, keyContainerName, or keyName | All three names read the same underlying text attribute. The read succeeds only when the attribute contains a nonempty value; an unset or empty value causes failure. |
| Storage provider | storageProvider or msStorageProvider | Both names read the same underlying text attribute. The read succeeds only when the attribute contains a nonempty value; an unset or empty value causes failure. |
| Local key ID | localKeyId | The read succeeds only when a nonempty local key ID is present. The value is always returned in decimal encoding as one big-endian integer, regardless of the encoding used when it was set. |
| Enhanced key usage | enhancedKeyUsage | Not readable through this method. The operation reports failure even if the attribute was previously set with SetSafeBagAttr. |
An unrecognized attrName name, an invalid index, an unreadable attribute, or any recognized attribute whose value is unset or empty causes the read to fail.
01 02 03 04 05 06 07 08 are returned as 72623859790382856. Leading zero bytes are not preserved by a set-read-set round trip because 00 01 02 03 and 01 02 03 represent the same integer.i, read localKeyId with forPrivateKey = .T. and index = i. If a nonempty value is returned successfully, pass it to CertByLocalKeyId using the encoding decimal. Never assume that certificate index i matches private-key index i.Returns .F. on failure
ImportToKeychain
Imports all certificates and private keys currently held by this Pfx object into the application's default keychain. This method is available only on macOS and iOS. On other platforms it returns .F. and reports that the method is macOS/iOS only.
The method does not accept a password. Any required password must already have been supplied when loading the PFX or PEM data; the objects presently contained in the Pfx are what this method imports.
opts is reserved for future use: The JsonObject currently has no defined members and does not affect the import. Pass an empty JsonObject. Any JSON members supplied today are ignored. The destination keychain, access group, key accessibility, iCloud synchronization, and replacement behavior are not configurable through this method.The certificates and private keys are imported into the application's platform-default keychain without assigning special access-group, accessibility, or synchronization attributes. Normal macOS or iOS keychain-access rules and application entitlements still apply.
The calling sequence is the same on macOS and iOS: load or build the Pfx, create an empty JsonObject, and pass it as opts.
Returns .T. for success, .F. for failure.
topImportToWindows
Imports the certificates and private keys in this PFX into Windows certificate stores and Windows key storage. This method is available only on Microsoft Windows.
| Argument | Name | Meaning |
|---|---|---|
exportable | exportable | Controls the legacy CryptoAPI exportability setting. This is the companion setting for the older certificate-import path; it is not the setting that determines exportability of the CNG-persisted key. |
userProtected | userProtected | When .T., enables Windows strong key protection, which can display an interactive prompt when the key is imported or used. When .F., key import and use are silent. |
machineKeyset | machineKeyset | Selects the scope for both private-key storage and certificate stores. .T. uses Local Machine; .F. uses Current User. Local Machine imports generally require elevation. |
allowOverwriteKey | allowOverwriteKey | When .T., an existing private key having the same key-container name may be overwritten. When .F., the import fails if that key already exists. |
allowExport | allowExport | Controls the private key as persisted by the CNG Microsoft Software Key Storage Provider. When .T., the key is marked plaintext-exportable and can later be exported, including as raw private-key material. This is the effective exportability control for the key installed by this method. |
leafStore | leafStore | Destination store for end-entity (leaf) certificates. |
intermediateStore | intermediateStore | Destination store for intermediate CA certificates. |
rootStore | rootStore | Destination store for root or self-signed certificates. |
extraOptions | extraOptions | Currently unused. It has no effect for any value. Pass an empty string. |
exportable applies to the legacy CryptoAPI path. allowExport applies to the CNG Key Storage Provider used to persist the private key and determines whether that installed key can actually be exported later. Set allowExport to .T. only when later private-key export is required, because it permits plaintext export.Store names are case-insensitive. Standard names include My for leaf certificates, CA or CertificationAuthority for intermediate certificates, and Root for trusted roots. For any certificate class, pass None, Nothing, or an empty string to skip importing that class. Other Windows store names, such as AddressBook, AuthRoot, TrustedPeople, and TrustedPublisher, may also be used when appropriate.
If a certificate already exists, it is updated or replaced rather than causing an error. Existing private keys are handled separately: when a key having the same key-container name exists, allowOverwriteKey determines whether it is overwritten or causes the import to fail. The key-container name comes from the private key's friendly name; if no friendly name exists, Chilkat generates a unique name.
allowOverwriteKey can replace an unrelated existing key when its container name matches the imported key's friendly name. Enable overwrite only when that name is known to identify the key that should be replaced..F. return can therefore leave partial results in Windows; applications requiring all-or-nothing behavior must inspect and clean up the target stores themselves.userProtected to .T. in a Windows service or another noninteractive process. The required protection prompt cannot be displayed and the operation may fail or hang. Use .F. for silent service and server operation.Root store makes it a trust anchor for the selected Current User or Local Machine scope. Import only roots that the application or administrator intentionally trusts. Use None for rootStore when root installation is not required.Common configurations:
| Scenario | Typical settings |
|---|---|
| Per-user, silent import | exportable=false, userProtected=false, machineKeyset=false, allowOverwriteKey=false, allowExport=false, leaf My, intermediate CA, root None. |
| Machine-wide service/server | Use the silent settings above with machineKeyset=true and run elevated. |
| Key must be exportable later | Set allowExport=true. Also set exportable=true when legacy CryptoAPI exportability is wanted. |
| Leaf certificate only | Use a real leaf store such as My and pass None for both intermediate and root stores. |
| Replace an existing key | Set allowOverwriteKey=true only after confirming that the key-container name cannot collide with an unrelated key. |
Returns .T. for success, .F. for failure.
LoadPem
Loads one or more certificate/private-key identities from the PEM-formatted text in pemStr and builds the contents of this Pfx object. password supplies the password when the PEM contains encrypted private keys.
The supported PEM block types are:
| PEM block | Meaning |
|---|---|
BEGIN CERTIFICATE | An X.509 certificate. |
BEGIN PRIVATE KEY | An unencrypted PKCS #8 private key. |
BEGIN ENCRYPTED PRIVATE KEY | A password-encrypted PKCS #8 private key. |
BEGIN RSA PRIVATE KEY | A traditional RSA private key, either unencrypted or password-encrypted. |
Multiple independent identities are supported. Each private key is paired with the certificate whose public key cryptographically matches it, and its chain is assembled from the other certificates in the PEM. Block order is therefore irrelevant; keys and certificates are not paired by position.
Returns .T. for success, .F. for failure.
LoadPfxBd
Loads a PFX / PKCS#12 container from the bytes currently held in bd. password is the password argument.
password accepts either a literal password, which is used for both integrity verification and all private-key bags, or a JSON object that can separately provide integrity, privKeys, and skipPrivateKeys. See LoadPfxFile for the exact JSON-detection rules, member types, defaults, and edge cases.Pfx object empty; previously loaded certificates and keys are not preserved.Returns .T. for success, .F. for failure.
LoadPfxEncoded
Decodes the text in encodedData using the binary encoding named by encoding, then loads the resulting bytes as a PFX / PKCS#12 container. Common encodings include base64 and hex.
password is the password argument.
password accepts either a literal password, which is used for both integrity verification and all private-key bags, or a JSON object that can separately provide integrity, privKeys, and skipPrivateKeys. See LoadPfxFile for the exact JSON-detection rules, member types, defaults, and edge cases.encoding describes how binary PFX bytes were represented as text. It does not control certificate-name character encoding or password interpretation.Pfx object empty; previously loaded certificates and keys are not preserved.Returns .T. for success, .F. for failure.
LoadPfxFile
Loads a PFX / PKCS#12 container from the file path in path. password follows the password contract below. The same contract is used by LoadPfxBytes, LoadPfxBd, and LoadPfxEncoded; it does not apply to LoadPem.
The password argument has two modes:
- Plain password: For any non-JSON value
P, Chilkat usesPfor both integrity verification and all private-key bags.skipPrivateKeysis.F.. - JSON options: After trimming leading and trailing whitespace, JSON mode is used only when the value begins with
{, ends with}, and parses as valid JSON. All three recognized members are optional and case-sensitive.
{
"integrity": "integrity-password",
"privKeys": "private-key-password",
"skipPrivateKeys": false
}| Member | Accepted value | Default when omitted |
|---|---|---|
integrity | String | Integrity verification is skipped. |
privKeys | String | The empty string is used as the password for every private-key bag. |
skipPrivateKeys | JSON Boolean true, or a string equal to true without regard to case | .F. |
Unknown JSON members are silently ignored. A misspelled member such as privkeys therefore does not produce a JSON error; the documented default is used instead. The single privKeys password applies to every private-key bag. Per-bag passwords are not supported.
skipPrivateKeys is true, private-key bags are not processed and the privKeys password is irrelevant. Integrity verification is still performed when an integrity member is supplied.integrity, for example {"skipPrivateKeys":true} or {}.integrity password does not validate the privKeys password. If integrity verification succeeds but private-key decryption fails, the load still fails unless private keys were skipped.Pfx object empty. Load into a new object when the previously loaded contents must be preserved on failure.Returns .T. for success, .F. for failure.
PrivateKeyAt
Copies the private key at the zero-based index index into privKey. The first private key is at index 0; valid indexes are less than NumPrivateKeys.
On success, privKey is replaced with an independent, detached copy of the selected private key. The method does not merge with or append to any key already held by privKey. The returned copy does not remain linked to the PFX: changing either object later does not affect the other, and the copied key remains usable even if the PFX is subsequently modified or destroyed.
index is out of range or the private key cannot be returned, the method returns .F. without modifying privKey. When reusing a PrivateKey object, use its contents only after this method returns .T.; otherwise privKey may still contain a key from an earlier successful call.PrivateKeyAt(i) is not necessarily associated with CertAt(i).GetSafeBagAttr with index set to .T., privKey set to this private-key index, and ARG3 set to localKeyId. If the attribute is present, pass the returned value to CertByLocalKeyId using decimal as the encoding.privKey as secret key material. Avoid unnecessary serialization, logging, or long-lived copies.Returns .T. for success, .F. for failure.
SetSafeBagAttr
Sets a safe-bag attribute on a private key or certificate contained in this PFX. A safe-bag attribute is metadata attached to an item inside a PKCS#12/PFX container; it does not change the certificate or private-key material itself.
forPrivateKeyis.T.to address a private key and.F.to address a certificate.indexis the zero-based index within the selected collection.nameis the attribute name. Attribute names are matched case-insensitively.valueis the value to set.encodingspecifies howvalueis decoded only when settinglocalKeyId. It is ignored for all text-valued attributes.
Setting a recognized attribute replaces its existing value; it never creates a duplicate attribute. The method returns .F. and makes no change if name is not one of the recognized names listed below.
| Logical attribute | Accepted name names | Value and behavior |
|---|---|---|
| Friendly name | friendlyName, keyContainerName, or keyName | These names refer to the same underlying text attribute. value is stored as text, and encoding is ignored. Setting through any alias replaces the value visible through every alias. |
| Storage provider | storageProvider or msStorageProvider | The two names refer to the same underlying text attribute. value is stored as text, and encoding is ignored. |
| Local key ID | localKeyId | A binary identifier commonly used to associate a private-key bag with its certificate bag. encoding specifies the encoding of value, such as hex, base64, or decimal. An empty value removes the attribute. |
| Enhanced key usage | enhancedKeyUsage | value is a comma-separated text list. Each item may be a recognized usage name, such as serverAuth, clientAuth, codeSigning, or emailProtection, or a dotted OID such as 1.3.6.1.5.5.7.3.1. Unrecognized items that are not valid OIDs are silently skipped. encoding is ignored. An empty value removes the attribute. This attribute is write-only through the safe-bag attribute API. |
hex, base64, or another encoding for those attributes has no effect.Returns .T. for success, .F. for failure.
ToBd
Serializes the current PFX contents as PKCS#12 data and writes the bytes to bd, using password as the output password.
bd is cleared before serialization begins. On success, it contains only the newly generated PFX data; the method replaces the previous BinData contents and never appends to them.
.F., the contents that bd held before the call are not restored. bd may be empty or may contain partially generated data. Use the destination only after a .T. return when complete output is required.The private-key encryption scheme is controlled by AlgorithmId and, for PBES2, the related algorithm properties.
bd may contain encrypted private-key material. Keep the password and resulting bytes protected even though they are stored only in memory.Returns .T. for success, .F. for failure.
ToEncodedString
Serializes the current PFX contents using password as the output password, then returns the PKCS#12 bytes encoded as text using encoding. Common choices for encoding are base64 and hex.
The PFX encryption settings are controlled by AlgorithmId and the PBES2 properties.
Returns .F. on failure
ToFile
Serializes the current PFX contents and writes the resulting PKCS#12 data to path, using password as the output password.
.pfx and .p12 are the conventional filename extensions for PKCS#12 containers. The private-key protection scheme is controlled by AlgorithmId and the PBES2 properties.
Returns .T. for success, .F. for failure.
ToJksObj
Populates jksObj with a Java KeyStore (JKS) representation of this PFX. One private-key entry is created for each private key, and certificates in the PFX are used to construct the corresponding certificate chains. password protects the generated private-key entries.
jksObj is cleared before conversion begins. On success, it contains only the newly converted key store; the method replaces the destination's previous entries rather than merging with them.
.F., the key store that jksObj held before the call is not restored. jksObj may be empty or partially populated. Use the destination only after a .T. return when a complete conversion is required.If alias is nonempty, it becomes the alias for the first private key. Otherwise, the alias is selected in this order:
- Certificate subject common name.
- Certificate subject email address.
- PKCS#9 friendly-name attribute.
- Certificate serial number.
Aliases for additional private keys are selected automatically using the same preference order.
Returns .T. for success, .F. for failure.
ToPem
Exports all private keys and certificates currently held by this object as PEM-formatted text. Certificates are written as standard BEGIN CERTIFICATE blocks.
Every private key is exported as unencrypted PKCS #8 in a BEGIN PRIVATE KEY block. This method does not emit PKCS #1 RSA, SEC 1 EC, traditional DSA, or legacy OpenSSL encrypted-private-key blocks.
ToPemEx to produce encrypted PKCS #8 private-key blocks or to omit selected categories of objects.Returns .F. on failure
ToPemEx
Exports selected PFX contents as PEM-formatted text. Certificates are written as standard BEGIN CERTIFICATE blocks. Private keys are always written in PKCS #8 form: BEGIN PRIVATE KEY when unencrypted, or BEGIN ENCRYPTED PRIVATE KEY when encrypted. Traditional PKCS #1 RSA, SEC 1 EC, DSA, and legacy OpenSSL encrypted-key PEM formats are not produced.
The arguments control the output as follows:
| Argument | Effect |
|---|---|
extendedAttrs | When .T., emits OpenSSL-style bag and key attribute text in addition to the PEM blocks. |
noKeys | When .T., omits private-key blocks. |
noCerts | When .T., omits all certificate blocks. |
noCaCerts | When .T., omits intermediate and root CA certificates while retaining applicable end-entity certificates. |
encryptAlg | Selects private-key encryption. Recognized keywords are aes128, aes192, aes256, des3, and 3des. Leave empty for unencrypted private keys. An unrecognized nonempty value falls back to triple-DES rather than silently producing unencrypted output. |
password | The password for encrypted private-key output. Encryption is applied only when both encryptAlg and password are nonempty. |
des3 and 3des use triple-DES in CBC mode with an 8-byte IV. The result is an encrypted PKCS #8 BEGIN ENCRYPTED PRIVATE KEY block.encryptAlg or password is empty, the output contains unencrypted PKCS #8 private-key material. Prefer aes256 for new encrypted output unless the receiving system requires another supported choice.Returns .F. on failure
UseCertVault
Adds the certificates currently contained in vault to the set of certificate sources available for later chain-building operations, such as AddCert.
The call captures a point-in-time snapshot of the vault's certificates. Chilkat retains its own lifetime-safe references to those individual certificates and does not retain a reference to the XmlCertVault object itself. After this method returns, vault may be released, destroyed, or allowed to go out of scope; its contributed certificates remain available to this Pfx object.
vault after this call are not automatically reflected here. Call UseCertVault again to capture certificates added later.Returns .T. for success, .F. for failure.
Deprecated
FindCertByLocalKeyId
Deprecated. Use CertByLocalKeyId instead.
Searches for a certificate whose certificate-bag localKeyId attribute matches the binary value supplied in localKeyId. encoding names the representation used for localKeyId, such as decimal, base64, or hex.
localKeyId was obtained from GetSafeBagAttr using the attribute name localKeyId, pass decimal for encoding. This lookup is the reliable way to find a key's matching certificate; collection indexes do not correspond.Returns .F. on failure
GetCert
Deprecated. Use CertAt instead.
Returns the certificate at the zero-based index specified by index. The first certificate is at index 0. An invalid index causes the method to fail and return no object.
GetCert(i) is not necessarily the certificate associated with GetPrivateKey(i). Use a matching localKeyId when one is present.Returns .F. on failure
GetPrivateKey
Deprecated. Use PrivateKeyAt instead.
Returns the private key at the zero-based index specified by index. The first private key is at index 0. An invalid index causes the method to fail and return no object.
GetPrivateKey(i) is not necessarily associated with GetCert(i). Use the private key's localKeyId and CertByLocalKeyId when that attribute is present.PrivateKey object contains secret key material. Avoid logging, displaying, or exporting it unless the application explicitly requires that operation.Returns .F. on failure
LastJsonData
Deprecated. Use GetLastJsonData instead.
Returns structured JSON information produced by the most recent operation that generated such data. The exact JSON members depend on the preceding method.
Returns .F. on failure
ToJavaKeyStore
Deprecated. Use ToJksObj instead.
Creates a Java KeyStore object with one private-key entry for each private key in this PFX. Certificates in the PFX are used to construct the certificate chain for each entry. password is used to protect the generated private-key entries.
If alias is nonempty, it is used as the alias for the first private key. Otherwise, the alias is chosen using the following order:
- Certificate subject common name.
- Certificate subject email address.
- PKCS#9 friendly-name attribute.
- Certificate serial number.
Additional private keys receive automatically selected aliases using the same preference order.
Returns .F. on failure