Importing and Extracting SSL Certificates (PFX) in Cloudmon Controller

Import an SSL certificate in PFX format onto the Cloudmon Controller and extract the required private key and full certificate chain files for use in Nginx HTTPS configuration.

Overview

A PFX (PKCS#12) file is a single, password-protected archive that bundles the private key, the server certificate, and the intermediate/chain certificates together. Nginx, however, requires these components as separate PEM-encoded files.

This article covers the complete workflow: importing the PFX file onto the Cloudmon Controller, extracting it into the required pvt.key and fullchain.crt files, placing them for Nginx use, and validating and reloading the configuration.

Prerequisites

• The PFX file (.pfx or .p12) issued by your CA.
• The PFX password used when the certificate was exported.
• OpenSSL installed on the Cloudmon Controller (verify with openssl version).
• Terminal access to the Cloudmon Controller host with sudo/root privileges.
• A backup of any existing certificate files currently in use by Nginx.

Resolution Steps

Step 1: Import the PFX certificate onto the Cloudmon Controller

Import the PFX file onto the Cloudmon Controller and place it in a working directory:

mkdir -p ~/ssl-import && cd ~/ssl-import

Once the PFX file (e.g. certificate.pfx) is in this directory, confirm it is readable and valid:

openssl pkcs12 -info -in certificate.pfx -noout

You will be prompted for the PFX password. A successful response lists the private key, certificate, and CA chain entries without errors, confirming the PFX is valid before extraction.

Step 2: Extract the private key and full certificate chain

Extract the private key:

openssl pkcs12 -in certificate.pfx -nocerts -nodes -out pvt.key

Extract the full certificate chain:

openssl pkcs12 -in certificate.pfx -nokeys -out fullchain.crt

If required, clean up certificate metadata (bag attributes, subject/issuer lines) left over from extraction:

sed -i '/^Bag Attributes/,/-----BEGIN/{/-----BEGIN/!d}' fullchain.crt

Step 3: Handle legacy PFX files (OpenSSL 3.x)

Older PFX files using legacy encryption (e.g. RC2-40-CBC or 3DES) may fail to extract on OpenSSL 3.x with errors such as:

Mac verify error: invalid password?

error:0308010C:digital envelope routines::unsupported

These errors typically do not mean the password is wrong — OpenSSL 3.x cannot process the legacy encryption algorithm by default. Add the -legacy flag to load the legacy provider:

openssl pkcs12 -legacy -in certificate.pfx -nocerts -nodes -out pvt.key

openssl pkcs12 -legacy -in certificate.pfx -nokeys -out fullchain.crt

Step 4: Place the extracted files in the Cloudmon Controller SSL directory

Copy the extracted files into the Nginx SSL directory used by the Cloudmon Controller:

/etc/nginx/ssl/

Typical files found in this directory:

cloudmon.key
cloudmon.crt
cloudmon_fullchain.crt

• cloudmon.key contains the private key.
• cloudmon_fullchain.crt contains the server certificate along with intermediate CA certificates.
• These files are used by Nginx for HTTPS configuration.

Copy the extracted files into place:

cp fullchain.crt /etc/nginx/ssl/cloudmon_fullchain.crt
cp pvt.key /etc/nginx/ssl/cloudmon.key

Set correct ownership and permissions:

chown root:root /etc/nginx/ssl/cloudmon_fullchain.crt /etc/nginx/ssl/cloudmon.key
chmod 644 /etc/nginx/ssl/cloudmon_fullchain.crt
chmod 600 /etc/nginx/ssl/cloudmon.key

Step 5: Validate the extracted certificate files

Check the certificate chain details:

openssl x509 -in fullchain.crt -text -noout

Check the private key:

openssl rsa -in pvt.key -check

Confirm the key and certificate match by comparing their modulus hashes:

openssl x509 -noout -modulus -in fullchain.crt | openssl md5
openssl rsa -noout -modulus -in pvt.key | openssl md5

If the two hashes differ, the key and certificate do not correspond to the same PFX and Nginx will fail to start.

Troubleshooting

• Incorrect PFX password — re-confirm the password; if correct, retry with -legacy.
• Missing intermediate certificates — re-extract with -nokeys (not -clcerts) to ensure the full chain is included.
• Legacy PFX format — add the -legacy flag to all pkcs12 extraction commands on OpenSSL 3.x.
• Permission issues in /etc/nginx/ssl/ — set 644 on certificate files and 600 on key files, owned by root.
• Nginx still serving the old certificate — validate the config with nginx -t, then reload Nginx.

Final Verification

Test the Nginx configuration syntax:

nginx -t

Then apply the new certificate without dropping active connections:

systemctl reload nginx

Confirm HTTPS is serving the updated certificate. If the issue persists after completing the above steps, collect the outputs from each step and share them with Cloudmon Support for further review.