unable to load certificate

OpenSSL 1.1.x wording. OpenSSL 3.5+ prints "Could not find certificate from cert.pem" plus a STORE-routines stack line (reproduced on 3.6). Wording varies by version; the failure is identical.

What it means

openssl x509 (or another certificate-consuming command) could not parse a certificate out of the file. The input is a different PEM object (key, CSR), the wrong binary encoding, or text that is not an X.509 structure at all — the command never got as far as reading fields. Since certificate files are named .crt or .cer regardless of encoding, the filename tells you nothing here; only the bytes do.

Why it happens

• The file holds a key or CSR, not a certificate

  common

  BEGIN PRIVATE KEY, BEGIN PUBLIC KEY or BEGIN CERTIFICATE REQUEST blocks are not certificates. CSRs in particular get mistaken for certs constantly — a CSR is what you send to a CA; the certificate is what comes back.

• DER certificate without -inform der

  common

  Windows-ecosystem .cer/.crt files are frequently binary DER. openssl x509 defaults to PEM and fails to find the armor.

• PKCS#7 / PKCS#12 bundle

  occasional

  .p7b and .pfx/.p12 files are containers holding certificates, not bare certificates. They need their own commands to unpack before x509 can read the contents.

How to fix it

1. 1.

   Identify, then convert

   Check the label or first bytes; convert DER to PEM if needed.

   head -1 cert.file          # BEGIN what?
   openssl x509 -inform der -in cert.der -out cert.pem   # DER → PEM

2. 2.

   Unpack container formats

   Extract certificates from PKCS#7 and PKCS#12 bundles into plain PEM.

   openssl pkcs7 -print_certs -in bundle.p7b -out certs.pem
   openssl pkcs12 -in bundle.pfx -clcerts -nokeys -out cert.pem

3. 3.

   For a CSR, use the req command

   If the file is a request, inspect it with req — and remember it still needs signing by a CA to become a certificate.

   openssl req -in request.csr -noout -text

← Browse the full signature error database