How to convert a CNG certificate to CryptoAPI certificate.

Information

Parallels MDM is using CryptoAPI and do not support Cryptographic New Generation (CNG) certificates.

In oder to check if the installed certificate is a CNG certificate or not please open CMD as Administrator on the Paralells Mac Management MDM server and execute the following command:

certutil.exe –v –store my> certutil_my.txt

In the output file(certutil_my.txt) find the certificate in question and locate KeySpec and ProviderType atributes. If they are cert to 0, this is a CNG certificate.

You may convert a CNG certificate using the steps below:

1. Download and extract the Win32 OpenSSL package to C:\ directory.

2. Create a folder c:\certs and copy the file mycert-cng.pfx(the CNG certificate) into the c:\certs folder.

3. Open a command prompt, and move to the OpenSSL-Win32\bin directory, using:

   cd C:\OpenSSL\bin  
   

4. Convert the CNG certificate to a .*pem format using the command below:

   openssl pkcs12 -in C:\certs\mycert-cng.pfx -out C:\certs\mycert.pem
   

5. Run the command below:

   openssl pkcs12 -export -in C:\certs\mycert.pem -out C:\certs\mycert-cryptoapi.pfx