imported>Just an user98：/* growthexperiments-addlink-summary-summary:3|0|0 */

2026-02-24T06:34:20Z

growthexperiments-addlink-summary-summary:3|0|0

新页面

{{NoteTA|G1=IT}}
{{Infobox file format
|name=PKCS #12
|extension=<tt>.p12</tt>, <tt>.pfx</tt>
|mime=application/x-pkcs12
|uniform_type=0
|developer=[[RSA 安全]]
|type=[[归档文件|归档文件格式]]
|released={{start date|1996}}
|latest_release_version=PKCS #12 v1.1
|latest_release_date={{Start date and age|2012|10|27|df=yes}}
|container_for=X.509 [[公開金鑰認證]]、X.509 [[公开密钥加密|私鑰]]、X.509 [[证书吊销列表]]、通用資料
|extended_from=微軟PFX檔案格式
}}

在[[密码学]]中，'''PKCS #12''' 定义了一种[[归档文件|归档文件格式]]，用于实现存储许多加密对象在一个单独的文件中。通常用它来打包一个私钥及有关的 [[X.509]] 证书，或者打包信任链的全部项目。<ref>{{Cite web |url=http://help.globalscape.com/help/secureserver3/Generating_a_PKCS_12_private_key_public_certificate.htm |title=存档副本 |accessdate=2017-10-21 |archive-date=2017-11-09 |archive-url=https://web.archive.org/web/20171109071742/http://help.globalscape.com/help/secureserver3/generating_a_pkcs_12_private_key_public_certificate.htm |dead-url=no }}</ref>

一个 PKCS #12 文件通常是被加密的，同时单独存在。其被称作「安全包裹」的内部存储容器通常同时也被加密及单独存在。一些安全包裹被预先定义用来存储证书，私钥以及[[证书吊销列表]]。根据不同实现者的选择，也可以使用一些安全包裹存储其他任意数据。
<ref>{{cite web|url=http://www.emc.com/emc-plus/rsa-labs/standards-initiatives/pkcs12-personal-information-exchange-syntax-standard.htm|title=PKCS #12: Personal Information Exchange Syntax Standard|accessdate=2016-02-09|publisher=[[RSA Laboratories]]|quote=This standard specifies a portable format for storing or transporting a user's private keys, certificates, miscellaneous secrets, etc.|archive-date=2017-04-17|archive-url=https://web.archive.org/web/20170417091802/http://www.emc.com/emc-plus/rsa-labs/standards-initiatives/pkcs12-personal-information-exchange-syntax-standard.htm|dead-url=no}}</ref><ref>{{cite web|url=ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-12/pkcs-12v1.pdf|title=PKCS 12 v1.0: Personal Information Exchange Syntax|accessdate=2013-03-14|date=1999-06-24|publisher=[[RSA Laboratories]]}}{{dead link|date=2018年5月 |bot=InternetArchiveBot |fix-attempted=yes }}
</ref>

PKCS #12 是 RSA 实验室发布的[[公钥密码学标准]]之中的一员。

PKCS #12 [[文件扩展名]]为 ".p12 "或者 ".pfx"。<ref name="dotnet">{{cite web|url=https://msdn.microsoft.com/en-us/library/ms867088.aspx|title=PKCS #12 File Types: Portable Protected Keys in .NET|accessdate=2013-03-14|author=Michel I. Gallant|date=March 2004|publisher=[[Microsoft Corporation]]|quote=All Windows operating systems define the extensions .pfx and .p12 as Personal Information Exchange, or PKCS #12, file types.|archive-date=2013-05-07|archive-url=https://web.archive.org/web/20130507200207/http://msdn.microsoft.com/en-us/library/ms867088.aspx|dead-url=no}}</ref>

这些文件可以通过使用 [[OpenSSL]] <code>pkcs12</code> 命令被创建、解析并读出。<ref name="openssl">{{cite web|url=https://www.openssl.org/docs/manmaster/man1/pkcs12.html|title=OpenSSL: Documents, pkcs12(1)|accessdate=2017-03-23|date=2013-01-17|publisher=[[OpenSSL]] Project|quote=The pkcs12 command allows PKCS#12 files (sometimes referred to as PFX files) to be created and parsed.|archive-date=2017-03-24|archive-url=https://web.archive.org/web/20170324174013/https://www.openssl.org/docs/manmaster/man1/pkcs12.html|dead-url=no}}</ref>

== 与PFX文件格式的关系 ==
PKCS #12 是[[微软]] PFX 文件的替代者；<ref>{{cite web|url=http://static.usenix.org/events/sec02/full_papers/gutmann/gutmann.pdf|title=Lessons Learned in Implementing and Deploying Crypto Software|accessdate=2013-03-14|author=[[Peter Gutmann (computer scientist)|Peter Gutmann]]|date=August 2002|publisher=[[The USENIX Association]]|quote=In 1996 Microsoft introduced a new storage format [...] called PFX (Personal Information Exchange) [...] it was later re-released in a cleaned-up form as PKCS #12|archive-date=2015-11-23|archive-url=https://web.archive.org/web/20151123192321/http://static.usenix.org/events/sec02/full_papers/gutmann/gutmann.pdf|dead-url=no}}</ref>
然而，"PKCS #12 文件" 和 "PFX 文件" 这两个词有时被相互替代使用用。<ref name="pgut001">{{cite web|url=http://www.cs.auckland.ac.nz/~pgut001/pubs/pfx.html|title=PFX - How Not to Design a Crypto Protocol/Standard|accessdate=2013-03-14|author=[[Peter Gutmann (computer scientist)|Peter Gutmann]]|date=1998-03-12|archive-date=2012-08-25|archive-url=https://web.archive.org/web/20120825095305/http://www.cs.auckland.ac.nz/~pgut001/pubs/pfx.html|dead-url=no}}</ref>

微软的 "PFX" 因作为最复杂的密码学协议之一而受到大量批评。

== 通常用法 ==
完整的PKCS #12标准非常复杂。它使得大量的复杂对象（例如[[wikipedia:PKCS_12|PKCS #12]]）可以深层次地嵌套。但在实际应用中通常只用来存储一个私钥以及与之有关的证书链。

PKCS #12 文件通常使用 [[OpenSSL]] 来创建，OpenSSL只支持在命令行界面使用单个私钥。在Java 8之后，可以使用Java密钥工具创建多个条目，但这很有可能不被其他系统所兼容。

对于PKCS #12来说，一个更简单的替代方案是使用 PEM 格式，它仅仅列出证书，可能还有与之有关的私钥，以[[Base32|Base 64]]字符串的形式存储于一个纯[[文本文件]]中。

也可以使用[[GnuTLS]]证书工具（参数 [[to PSK #11]]]来创建包含证书、密钥、CA认证证书的PKCS #12文件。然而，要注意与其他软件的可交换性。如果源是通过Base 64处理过的字符串，则输出也同样应该使用Base 64。

== 参考文献 ==
{{reflist}}

== 外部链接 ==
* {{Cite web|url=http://www.emc.com/emc-plus/rsa-labs/standards-initiatives/pkcs12-personal-information-exchange-syntax-standard.htm|title=PKCS #12 v1.1: Personal Information Exchange Syntax|publisher=[[RSA Laboratories]]|accessdate=2017-10-21|archive-date=2017-04-17|archive-url=https://web.archive.org/web/20170417091802/http://www.emc.com/emc-plus/rsa-labs/standards-initiatives/pkcs12-personal-information-exchange-syntax-standard.htm|dead-url=no}}

* {{Cite IETF|year=2014|month=July|title=PKCS #12: Personal Information Exchange Syntax v1.1|rfc=7292|publisher=[[Internet Engineering Task Force|IETF]]|editor1-last=Moriarty|editor1-first=K.}}

* Overview about PKCS#12 capabilties, usage, implementations, history and future: {{Cite web|url=https://unmitigatedrisk.com/?p=543|title=The PKCS#12 standard needs another update|author=[https://twitter.com/rmhrisk Ryan Hurst] and [https://twitter.com/yurystrozhevsky Yury Strozhevsky]|date=2015-12-02|publisher=Unmitigated Risk Blog|archiveurl=https://archive.today/20170303104212/https://unmitigatedrisk.com/?p=543|archivedate=2017-03-03|deadurl=yes|accessdate=2017-10-21}}

[[Category:密码学]]

PKCS 12 - 版本历史

imported>Just an user98：​/* growthexperiments-addlink-summary-summary:3|0|0 */

imported>Just an user98：/* growthexperiments-addlink-summary-summary:3|0|0 */