It works fine on Windows 10, but when I try to import the same .pfx file on a Windows server 2012 it fails with the message "The password you entered is incorrect".
I use OpenSSL 3.0.0 to create my certificate, private key and .pfx file. I am certain that I use the correct password.
Is there any reason why I would not be able to import a .pfx file on a Windows server 2012?
I ran into the same problem with OpenSSL 3 and Windows Server 2012 R2. However, I eventually put together the correct combination of parameters. This seems to work:
openssl pkcs12 -export -certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES -nomac -inkey contoso.com.key -in contoso.com.crt -out contoso.com-legacy.pfx
It turns out that OpenSSL 3.0.0 uses AES256 as a default to encrypt the private key when exporting a .pfx file.
AES256 is apparently not supported on older versions of Windows according to this forum post.
When I tried to create my .pfx file with OpenSSL 1.1.1 it worked fine. This is apparently because OpenSSL 1.1.1 uses trippleDES as a default to encrypt the private key when exporting .pfx files.
Also worth noting that you will get this error if you attempt to import a .pfx file into a Windows Server that has not been 'Activated'.
Once the Server is Activated it will import fine.
Stumbled on the same issue trying to generate a .pfx and import it into Windows Server 2012 R2, and the other answers and comments involving -certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES and/or -nomac didn't work for me.
What finally worked for me is to use the -legacy option.
From the manpage:
-legacy
Use legacy mode of operation and automatically load the legacy provider. If OpenSSL is not installed system-wide, it is necessary to also use, for example, "-provider-path ./providers" or to set the environment variable OPENSSL_MODULES to point to the directory where the providers can be found.
In the legacy mode, the default algorithm for certificate encryption is RC2_CBC or 3DES_CBC depending on whether the RC2 cipher is enabled in the build. The default algorithm for private key encryption is 3DES_CBC. If the legacy option is not specified, then the legacy provider is not loaded and the default encryption algorithm for both certificates and private keys is AES_256_CBC with PBKDF2 for key derivation.
For those who still bang their head against the wall with the same problem. My stupid bank started issuing these AES256 certificates that are password protected. It comes in the form of a .pfx file. As you can guess older versions of Windows (like Windows 7) cannot import that one and the error is confusing too: "password is not correct".
Solution: Import rhe .pfx into a newer version of Windows (Like Windows 10) . This is important. When importing, mark the certificate as exportable. This allows you to export the certificate afterwards with the older Triple-DES-SHA1 algorithm or/and with no password to protect the key. Then import in your older system. Cheers.