(Tcl) Export a Certificate's Private Key to Various Formats

Loads a digital certificate and private key from a PFX file (also known as PKCS#12) and exports the private key to various formats: (1) PKCS8 Encrypted, (2) PKCS8 Encrypted PEM, (3) PKCS8 unencrypted, (4) PKCS8 PEM unencrypted, (5) RSA DER unencrypted, (6) RSA PEM unencrypted, (7) XML.

Chilkat Tcl Extension Downloads Chilkat Tcl Extension Downloads

load ./chilkat.dll

set cert [new_CkCert]

# Load from the PFX file
set pfxFilename "/Users/chilkat/testData/pfx/chilkat_ssl_pwd_is_test.pfx"
set pfxPassword "test"

# A PFX typically contains certificates in the chain of authentication.
# The Chilkat cert object will choose the certificate w/
# private key farthest from the root authority cert.
# To access all the certificates in a PFX, use the 
# Chilkat certificate store object instead.
set success [CkCert_LoadPfxFile $cert $pfxFilename $pfxPassword]
if {$success != 1} then {
    puts [CkCert_lastErrorText $cert]
    delete_CkCert $cert
    exit
}

# Get the private key...
# privKey is a CkPrivateKey

set privKey [CkCert_ExportPrivateKey $cert]
if {[CkCert_get_LastMethodSuccess $cert] == 0} then {
    puts [CkCert_lastErrorText $cert]
    delete_CkCert $cert
    exit
}

# Export to various formats:

set password "secret"

# PKCS8 Encrypted DER
set path "/Users/chilkat/testData/privkeys/chilkat_pkcs8_enc.der"
set success [CkPrivateKey_SavePkcs8EncryptedFile $privKey $password $path]
if {$success != 1} then {
    puts [CkPrivateKey_lastErrorText $privKey]
    delete_CkPrivateKey $privKey

    delete_CkCert $cert
    exit
}

# PKCS8 Encrypted PEM
set path "/Users/chilkat/testData/privkeys/chilkat_pkcs8_enc.pem"
set success [CkPrivateKey_SavePkcs8EncryptedPemFile $privKey $password $path]
if {$success != 1} then {
    puts [CkPrivateKey_lastErrorText $privKey]
    delete_CkPrivateKey $privKey

    delete_CkCert $cert
    exit
}

# PKCS8 Unencrypted DER
set path "/Users/chilkat/testData/privkeys/chilkat_pkcs8.der"
set success [CkPrivateKey_SavePkcs8File $privKey $path]
if {$success != 1} then {
    puts [CkPrivateKey_lastErrorText $privKey]
    delete_CkPrivateKey $privKey

    delete_CkCert $cert
    exit
}

# PKCS8 Unencrypted PEM
set path "/Users/chilkat/testData/privkeys/chilkat_pkcs8.pem"
set success [CkPrivateKey_SavePkcs8PemFile $privKey $path]
if {$success != 1} then {
    puts [CkPrivateKey_lastErrorText $privKey]
    delete_CkPrivateKey $privKey

    delete_CkCert $cert
    exit
}

#  RSA DER (unencrypted)
set path "/Users/chilkat/testData/privkeys/chilkat_rsa.der"
set success [CkPrivateKey_SavePkcs1File $privKey $path]
if {$success != 1} then {
    puts [CkPrivateKey_lastErrorText $privKey]
    delete_CkPrivateKey $privKey

    delete_CkCert $cert
    exit
}

# RSA PEM (unencrypted)
set path "/Users/chilkat/testData/privkeys/chilkat_rsa.pem"
set success [CkPrivateKey_SavePemFile $privKey $path]
if {$success != 1} then {
    puts [CkPrivateKey_lastErrorText $privKey]
    delete_CkPrivateKey $privKey

    delete_CkCert $cert
    exit
}

# XML (unencrypted)
set path "/Users/chilkat/testData/privkeys/chilkat.xml"
set success [CkPrivateKey_SaveXmlFile $privKey $path]
if {$success != 1} then {
    puts [CkPrivateKey_lastErrorText $privKey]
    delete_CkPrivateKey $privKey

    delete_CkCert $cert
    exit
}

delete_CkPrivateKey $privKey

puts "Private key exported to all formats."

delete_CkCert $cert