How to convert a CNG certificate to CryptoAPI certificate.

9 users found this article helpful


Parallels MDM is using CryptoAPI and do not support Cryptographic New Generation (CNG) certificates.

In oder to check if the installed certificate is a CNG certificate or not please open CMD as Administrator on the Paralells Mac Management MDM server and execute the following command:

certutil.exe –v –store my> certutil_my.txt

In the output file(certutil_my.txt) find the certificate in question and locate KeySpec and ProviderType atributes. If they are cert to 0, this is a CNG certificate.


You may convert a CNG certificate using the steps below:

  1. Download and extract the Win32 OpenSSL package to C:\ directory.

  2. Create a folder c:\certs and copy the file mycert-cng.pfx(the CNG certificate) into the c:\certs folder.

  3. Open a command prompt, and move to the OpenSSL-Win32\bin directory, using:

    cd C:\OpenSSL\bin  
  4. Convert the CNG certificate to a .*pem format using the command below:

    openssl pkcs12 -in C:\certs\mycert-cng.pfx -out C:\certs\mycert.pem
  5. Run the command below:

    openssl pkcs12 -export -in C:\certs\mycert.pem -out C:\certs\mycert-cryptoapi.pfx

Was this article helpful?

Tell us how we can improve it.