How to Inspect a PFX or P12 File Without Exporting the Private Key

Someone hands you a .pfx file and asks whether it’s the right certificate for a deployment. Before extracting anything, check what the bundle contains.

openssl pkcs12 -in bundle.p12 -info -noout

OpenSSL prompts for the archive password and reports the bag types and encryption algorithms. A Shrouded Keybag indicates an encrypted private-key bag. Certificate bag lines indicate certificates. The -noout flag suppresses credential output.

Check the certificate’s DNS names and expiry

For an archive with one identity, extract the public certificate and inspect it:

openssl pkcs12 -in bundle.p12 -clcerts -nokeys -out leaf.pem
openssl x509 -in leaf.pem -noout -subject -issuer -dates -ext subjectAltName

Check the Subject Alternative Name against the hostname your client uses. Check both validity dates, especially if the certificate was just issued. If the archive contains several identities, match the certificate to the expected entry before running openssl x509, which reads the first certificate in the PEM file.

What if OpenSSL reports RC2-40-CBC?

For a legacy archive you’re authorized to inspect, try loading the legacy provider for this command:

openssl pkcs12 -legacy -in bundle.p12 -info -noout

If the consuming application supports modern PKCS#12 encryption, re-export the archive with modern defaults and verify the certificate and chain before switching over.

I maintain PKIScope. The original PFX/P12 guide also covers inspecting intermediates and comparing the archive with what your TLS server actually presents.