Stack Exchange Network

Stack Exchange network consists of 183 Q&A communities including Stack Overflow , the largest, most trusted online community for developers to learn, share their knowledge, and build their careers. Visit Stack Exchange

Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.

Sign up to join this community

Teams

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

Learn more about Teams

I have a p12 store. I have read about export like this openssl pkcs12 -in path.p12 -out newfile.key.pem -nocerts -nodes but it doesn't export in EC format.

How do I do I use openssl to export the private key in EC format?

I read that the exported key should begin with -----BEGIN EC PRIVATE KEY-----

Are you sure your .p12 contains an EC key? If you were able to successfully export a private key, and it called itself an RSA or DSA private key, then that's what kind of key you have inside that .p12. You can't "convert" an RSA or DSA key to EC; they're completely separate algorithms based on completely different math. It's not like they're just big random numbers that you can choose to use with any algorithm you'd like. – Spiff Sep 1, 2020 at 20:00 Well if the command you wrote in your Question created a .pem file that just says "-----BEGIN PRIVATE KEY-----" without specifying the type, you could try using openssl ec -in newfile.key.pem -text to see if it's parsable as an EC key. If it says it can't load the key, change the subcommand from ec to rsa in my command, to see if it parses as RSA. If that still fails, change the subcommand to dsa . One of those should work. – Spiff Sep 1, 2020 at 21:05 The rsa version of the command worked 👍. Do I need to go through some steps to convert it to ec now? rsa -> der -> ec? – joels Sep 1, 2020 at 21:52 It is mathematically impossible to convert an RSA key to an EC key. They are based on completely different underlying mathematical principles. If you need an EC-based key pair, you'll need to generate an EC-based key pair from scratch. It won't be in any way related to your current RSA key pair in your current .p12, because EC and RSA are based on completely separate mathematical algorithms. – Spiff Sep 1, 2020 at 23:50

If you are certain that your key is in fact an EC key, you are halfway there.
Once exported the key with

 openssl pkcs12 -in path.p12 -nodes -nocerts -out newfile.key.pem
then convert it to EC PRIVATE KEY using below command
openssl ec -in newfile.key.pem -out ec.key.pem
More info here