title: How can I convert a pem private key to a format for windows that can be used in .NET
body: <p>I have a been given a private key that turned out to be in pkcs8 format, which I managed to turn into a pem file using the following command:</p>
  
  <pre><code>openssl pkcs8 -inform der -nocrypt -in private.key -out pkey.pem
  </code></pre>
  
  <p>I now need to convert this to pkcs12 so I can use it in .NET to create an X509 certificate (also I'd like to import it to windows cert manager).</p>
  
  <p>I tried this command:</p>
  
  <pre><code>openssl pkcs12 -export -name myalias -in mycert.crt -inkey pkey.pem -out keystore.p12
  </code></pre>
  
  <p>however, I don't have the public key, I've tried using the pkey.pem file as the -in arg, but it tells me <code>No certificate matches private key</code>. If I try without the <code>-in</code> arg then nothing happens (and I mean nothing, there is a blank row until I press <code>ctrl-c</code>).</p>
  
  <p>How can I generate the public key from the private key, or convert to pkcs12 without the public key?</p>
  
  <p>The first part of this question, was <a href="https://stackoverflow.com/a/19443854/198048">from the answer here</a></p>
  
  <p>I <a href="https://stackoverflow.com/a/18518383/198048">found an answer</a> that gave me some hope, which says to run this command (-nocerts):</p>
  
  <pre><code>openssl pkcs12 -export -nocerts -inkey your.private.key.pem -out your.private.key.p12
  </code></pre>
  
  <p>But when I try to import the file into the windows key store, it says <code>The specified file is empty</code> when it is importing.</p>
  
  <p>I've also managed to generate a certificate signing request <a href="http://www.sslshopper.com/article-most-common-openssl-commands.html" rel="nofollow noreferrer">from instructions here</a>, which generated a certificate file, but the command still didn't accept that saying <code>No certificate matches private key</code></p>
  
  <p><a href="https://stackoverflow.com/a/10271238/198048">Another answer</a> suggests generating the public key, which I do, but when I use that as the <code>-in</code> arg it still says <code>No certificate matches private key</code>, which I don't understand as this public key was generated from the private key using this command: <code>openssl rsa -in privkey.pem -pubout &gt; key.pub</code></p>
  
  <p>EDIT:
  I've posted an answer below, but as mentioned I've no way of verifying this information or telling if it works. If anyone has any further information, please let me know.</p>