Knowledge Base

How to generate a CSR and export a PKCS12 certificate on macOS

Updated on August 14, 2026

Overview

By the end of this article, you will have a working SSL/TLS certificate bundled with its private key in a single Public-Key Cryptography Standards #12 (PKCS12) file, ready to install on a macOS host or application. The article covers four things in order: the prerequisites you need before starting; generating a Certificate Signing Request (CSR) with the OpenSSL command-line tool; submitting that CSR and completing email validation in the Sectigo portal; and collecting the issued certificate and exporting it in PKCS12 format.

A CSR is the encoded request file that carries your public key and organization details to the Certificate Authority (CA). A PKCS12 file (extension .p12 or .pfx) is a single password-protected container that holds both the certificate and its matching private key.

Product: SSL/TLS certificate
Platform: macOS
Audience: IT administrators, developers, and security professionals who manage SSL/TLS certificates.

Prerequisites

Before you begin, make sure you have:

A macOS device with access to the Terminal application.
OpenSSL installed. OpenSSL ships with macOS by default; confirm with openssl version.
An active SSL/TLS certificate order in your Sectigo account, and its order number.
Access to the contact email address used when the certificate was ordered. Validation email is sent to that address only.

Step 1 — Generate a CSR in the macOS Terminal

A Certificate Signing Request (CSR) is generated on the machine that will host the certificate, so that the private key never leaves that machine.

Open Terminal on your macOS device.
Run the following command:

openssl req -newkey rsa:2048 -keyout private.key -out request.csr -nodes

Answer the prompts (country, organization, common name). The common name must exactly match the domain the certificate will secure.

The command produces two files in the current directory: private.key (your private key) and request.csr (the request you submit to Sectigo).

What each option does

Option	Purpose
req	Runs the CSR operation.
-newkey	Generates a new key pair (private key and public key).
rsa:2048	Sets the key type to Rivest–Shamir–Adleman (RSA) and the key size to 2048 bits.
-keyout	Names the file that stores the private key.
-out	Names the file that stores the generated CSR.
-nodes	Leaves the private key unencrypted, so no passphrase is required at load time.

Important: Store private.key securely and do not share it with anyone. You will need this exact file again in Step 3 to export the PKCS12 bundle. If the private key is lost, the certificate must be reissued.

Step 2 — Submit the CSR in the Sectigo portal

In this step you attach the Certificate Signing Request (CSR) created in Step 1 to your existing certificate order.

Sign in to the Sectigo store at https://store.sectigo.com/ .
Select My Products and Services.

Figure 1: Sectigo store account page with the My Products and Services option selected
Locate your certificate order and select Setup next to it.
Enter the Contact Email Address. This must match the address used when the certificate was ordered.

Figure 2 and 3: Certificate setup form with the contact email address and pasted CSR fields
Open request.csr in a text editor, copy its full contents (including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines), paste it into the CSR field, and select Submit.
Review the order details on the confirmation screen and complete the setup.

Step 3 — Complete email validation

Sectigo confirms that you control the contact address before the Certificate Authority (CA) issues the certificate.

Open the validation email sent to the contact address you entered in Step 2. Delivery usually takes a few minutes.
Select the validation link in the email.
Enter the validation code from the email on the page that opens, and submit it.

Validation is complete when the page confirms the code was accepted. If the email does not arrive, check the junk folder and confirm the contact address on the order is correct.

Figure 4 and 5: Validation email containing the validation link and code

Step 4 — Collect the certificate and export it in PKCS12 format

Once validation succeeds, Sectigo sends a collection email to the same contact address.

Open the collection email and select the collection link.
Upload the private.key file created in Step 1 when prompted.
Download the certificate in PKCS12 format. Set a strong export password when asked — you will need it whenever the file is imported.

The result is a single .p12 file containing your certificate and its matching private key.

Figure 6 and 7: Certificate collection screen with PKCS12 selected and the private key uploaded for certificate export

How to verify success

Confirm the export worked by running the following command in Terminal, replacing certificate.p12 with your downloaded file name:

openssl pkcs12 -info -in certificate.p12 -noout

Enter the export password when prompted. The command lists the certificate and private key contained in the file. If it returns a MAC verification error, the password is incorrect; if it reports no private key, repeat Step 4 and upload the correct private.key file.