Error Loading a PFX File: The Specified Network Password Is Not Correct

When a PFX (PKCS#12) file is loaded on Windows, the components may fail with the following error, even when the password is correct:

Cannot open certificate store: The specified network password is not correct.

By default, PFX files are opened on Windows using the CryptoAPI of the operating system, and this is the message Windows returns for any PFX file it cannot decrypt. Besides an incorrect password, the most common causes are described below.

PFX Files Created with OpenSSL 3

Starting with OpenSSL 3.0, the openssl pkcs12 -export command encrypts PFX files with AES-256 (PBES2 with PBKDF2 and SHA-256) by default, instead of the older 3DES and RC2 algorithms. Older versions of Windows (e.g., Windows Server 2016 and earlier) do not support this format, and report it as an incorrect password.

To create a PFX file that these versions of Windows can open, export it again with the older algorithms:

openssl pkcs12 -export -in cert.pem -inkey key.pem -out cert.pfx -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -macalg sha1

An existing PFX file can be converted by first extracting its contents (openssl pkcs12 -in cert.pfx -out cert.pem -nodes), and then exporting the resulting PEM file with the command above. The -legacy option of OpenSSL 3 can also be used, but it requires the OpenSSL legacy provider.

Loading the File with the Internal Security API

Alternatively, the file can be loaded with the internal security API of the components, which supports both the older algorithms and AES-256, and does not depend on the version of Windows. To do this, pass UseInternalSecurityAPI=true in the configuration string of the Certificate constructor:

Certificate cert = new Certificate(CertStoreTypes.cstPFXFile, "C:\\certs\\cert.pfx", "password", "*", "UseInternalSecurityAPI=true");

In .NET (formerly .NET Core) applications, PFX files are always loaded with the internal security API, so this error does not occur for these reasons.

Other Causes

• The password contains characters that were encoded differently when the file was created (e.g., non-ASCII characters). In this case, export the file again with a password that contains only ASCII characters.
• The file is not a PFX file, or was corrupted when it was transferred (e.g., an FTP transfer in ASCII mode). In this case, transfer the file again in binary mode.