pkcs12_parser #

Pure-Dart PKCS#12 (.pfx / .p12) parser — extracts the certificate, private key and public key from a password-protected container without OpenSSL or FFI. Works in any Dart or Flutter environment (mobile, desktop, server). The only dependency is pointycastle.

Usage #

import 'dart:io';
import 'package:pkcs12_parser/pkcs12_parser.dart';

void main() {
  final bytes = File('my.pfx').readAsBytesSync();

  final pfx = Pkcs12.load(bytes, 'password');

  final cert = pfx.certificate;        // X509CertificateDer (raw DER + PEM)
  final privateKey = pfx.privateKey;   // RSAPrivateKey or ECPrivateKey
  final publicKey = pfx.publicKey;     // RSAPublicKey or ECPublicKey

  print(pfx.privateKeyPem);            // -----BEGIN PRIVATE KEY----- (PKCS#8)
  print(pfx.certificatePem);           // -----BEGIN CERTIFICATE-----
  print(pfx.caChainPem);               // CA chain, issuer-ordered
}

The key objects are plain pointycastle types (re-exported by this package), ready for signing/decryption:

switch (pfx.privateKey) {
  case RSAPrivateKey key:
    print('RSA, ${key.modulus!.bitLength} bits');
  case ECPrivateKey key:
    print('EC on ${key.parameters!.domainName}');
}

Supported formats #

• Legacy PBES1 (Windows exports, OpenSSL ≤ 1.x, openssl pkcs12 -legacy): pbeWithSHA1And3-KeyTripleDES-CBC, 2-KeyTripleDES, RC2-40/128, RC4-40/128, using the RFC 7292 appendix B KDF with BMPString passwords.
• Modern PBES2 (OpenSSL 3.x default): PBKDF2 (hmacWithSHA1/256/384/512) with AES-128/192/256-CBC or des-EDE3-CBC.
• MAC verification: HMAC-SHA1/SHA256/SHA384/SHA512 over the authenticated safe, on by default (verifyMac: false to skip). null and '' passwords are distinct encodings; both are tried automatically, as OpenSSL does.
• Keys: RSA (PKCS#1) and EC (RFC 5915 — P-256/384/521, secp256k1, brainpool). Key ↔ certificate pairing via localKeyId, falling back to public-key comparison.

Error handling #

All failures throw a subtype of Pkcs12Exception:

CLI #

dart run pkcs12_parser <file.p12> [password]   # prints key + certs as PEM

Tests #

dart test

Fixtures in test/fixtures/ were generated once with OpenSSL 3.x (see test/fixtures/README.md); OpenSSL is not needed to run the tests or use the package.