(Objective-C) Get Certificates from .p12 / .pfx

A PKCS12 (.p12 / .pfx) is a container for holding a certificate, its private key, and the certs in the chain of authentication up to and possibly including the root CA cert. A .p12 is not required to contain certain things. It will contain whatever the creator of the .p12 decided to include. It's possible to contain just a private key, just a cert, many certs without private keys, or many certs with many private keys. Usually, a .p12 contains one certificate, its associated private key, and certificates in the chain of authentication.

Chilkat Objective-C Library Downloads MAC OS X (Cocoa) Libs iOS Libs

#import <CkoPfx.h>
#import <CkoCert.h>

CkoPfx *pfx = [[CkoPfx alloc] init];

BOOL success = [pfx LoadPfxFile: @"qa_data/pfx/test.pfx" password: @"pfx_password"];
if (success == NO) {
    NSLog(@"%@",pfx.LastErrorText);
    return;
}

// Iterate over the certs contained in the PFX
int numCerts = [pfx.NumCerts intValue];
int i = 0;
while (i < numCerts) {
    CkoCert *cert = [pfx GetCert: [NSNumber numberWithInt: i]];

    NSLog(@"%@%d%@",@"--- ",i,@" ---");
    NSLog(@"%@",cert.SubjectDN);
    // Is this a root cert, or self-signed?
    NSLog(@"%@%d",@"Root: ",cert.IsRoot);
    NSLog(@"%@%d",@"Self-Signed: ",cert.SelfSigned);

    // If this certificate is not the root (self-signed), then get the issuer.
    // If the issuing certificate is contained in the PFX, then it will be found here..
    if (cert.SelfSigned != YES) {
        CkoCert *issuer = [cert FindIssuer];
        if (cert.LastMethodSuccess == NO) {
            NSLog(@"%@",@"Issuer not found.");
        }
        else {
            NSLog(@"%@%@",@"Issuer: ",issuer.SubjectDN);

        }

    }

    i = i + 1;
}

// Usually, the user certificate is at index 0, its issuer is at index 1, etc. until we get to the root certificate.