How to create PKCS#12 certificates?

[Gapoly]

Hello, I'm trying to create a PKCS#12 but I can't find any doc on it. This is what I tried but didn't work :

curl https://get.acme.sh | sh
source ~/.bashrc

export CF_Token="sdfsdfsdfljlbjkljlkjsdfoiwje"

acme.sh --issue \
  --dns dns_cf \
  -d *.mydomain.fr \
  --keylength ec-256 \
  --server letsencrypt

acme.sh --install-cert -d *.mydomain.fr \
  --ecc \
  --pfx-file       /etc/ssl/private/mydomain.p12 \
  --pfx-password  'MYPASSWORD' \
  --reloadcmd     "systemctl restart dns"

This is the error I get

[Sat Dec 13 16:28:18 UTC 2025] Unknown parameter: --pfx-file

I'm on acme.sh v3.1.3.
Thanks for the help.

[github-actions]

Please upgrade to the latest code and try again first. Maybe it's already fixed. acme.sh --upgrade If it's still not working, please provide the log with --debug 2, otherwise, nobody can help you.

[Gapoly]

I'm already up to date and --debug 2 doesn't give more context

[invario]

https://github.com/acmesh-official/acme.sh/wiki#3-how-to-get-pkcs12pfx-format

3. How to get pkcs12(pfx) format:
   After you issue the cert, you can use the toPkcs command to convert the cert to pkcs12(pfx) format

acme.sh --toPkcs -d <domain> [--password pfx-password]
Important note: If you do not specify a password on the command line, OpenSSH itself will prompt you for one and the pkcs12(pfx) file will be generated. However, it will not be regenerated during certificate renewal. You must specify a non-blank password on the command line in order for acme.sh to regenerate the pkcs12(pfx) when renewing certificates.

[Gapoly]

Thanks that worked but there can be some limitation by using that.

When using that command, the certificate goes to /root/.acme.sh/*.domain.com_ecc/*.domain.com.pfx. Luckily Technitium run as root but what if a service doesn't run as root?

Can I just move that certificate elsewhere?

Also how do I setup auto renewal for a pfx?

You must specify a non-blank password on the command line in order for acme.sh to regenerate the pkcs12(pfx) when renewing certificates.

In my crontab I have 44 14 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null. In my /root/.acme.sh"/acme.sh at line 1455 I have pfxPassword="$5".

Should I remove $5 and put the blank password of the pfx there?

Will auto-renewal works if you move the file?

[invario]

It doesn't sound like you have configured things properly if the pfx is being created somewhere you don't want it to be created. If it's being created in /root/.acme.sh/*.domain.com_ecc/*.domain.com.pfx that means at some point you configured your domain to use /root/.acme.sh/*.domain.com_ecc/ as its working directory, and obviously that would require root. If you want it elsewhere, you need to have its working directory outside in a different folder that your non-root user will have access to.

You should not be modifying the acme.sh to perform configuration. The password should have been stored/saved inside your domain.com.conf already. You do not need to manually tell the pfx to renew. Renewing the certificate automatically will also renew the pfx provided you entered the required password when you generated the pfx.

[invario]

Kindly refer here with regards to how to setup your "home" and "cert home" directories properly when you issued the certificate. https://github.com/acmesh-official/acme.sh/wiki/How-to-install