How to convert a CNG certificate to CryptoAPI certificate.

12 users found this article helpful


Parallels MDM is using CryptoAPI and do not support Cryptographic New Generation (CNG) certificates.

In oder to check if the installed certificate is a CNG certificate or not please open CMD as Administrator on the Paralells Mac Management MDM server and execute the following command:

certutil.exe –v –store my> certutil_my.txt

In the output file(certutil_my.txt) find the certificate in question and locate KeySpec and ProviderType atributes. If they are cert to 0, this is a CNG certificate.


You may convert a CNG certificate using the steps below:

  1. Download and extract the Win32 OpenSSL package to C:\ directory.

  2. Create a folder c:\certs and copy the file mycert-cng.pfx(the CNG certificate) into the c:\certs folder.

  3. Open a command prompt, and move to the OpenSSL-Win32\bin directory, using:

    cd C:\OpenSSL\bin  
  4. Convert the CNG certificate to a .*pem format using the command below:

    openssl pkcs12 -in C:\certs\mycert-cng.pfx -out C:\certs\mycert.pem
  5. Run the command below:

    openssl pkcs12 -export -in C:\certs\mycert.pem -out C:\certs\mycert-cryptoapi.pfx

Was this article helpful?

Tell us how we can improve it.