🚀 Quick Start

Prerequisites

Ensure you have openssl installed and executable in your environment.

Installation

Clone the repository and make the scripts executable:

git clone https://github.com/al-heisner/cert_utils.git
cd cert_utils
chmod +x *.sh

Usage

Run the primary extraction script directly:

./pkcs_extract.sh [<certfile>]

Parameter / Variable	Type	Description
<certfile>	Optional	Path to your .pfx file. If omitted and only one .pfx exists in the folder, it is auto-selected.
PASS	Env Var	Optional environment variable to bypass the manual password prompt (e.g., PASS="your_password" ./pkcs_extract.sh).

---

🛠️ What This Script Solves

When deploying newly issued GoDaddy certificates through the Azure Portal, browsers often throw an ERR_CERT_AUTHORITY_INVALID warning. This happens because Azure includes GoDaddy's new self-signed R1 root CA, which is not yet fully distributed across all client browsers.

This utility automates the fix:

1. Extracts the .pfx store contents into separate PEM files.
2. Injects the cross-signed R1 certificate (signed by G2).
3. Rebuilds a compliant certificate chain ending with the widely trusted G2 root CA.

More info

More information about Godaddy's R1 root certificate is here: https://www.godaddy.com/en/help/why-is-godaddy-removing-clientauth-eku-and-transitioning-to-the-r1-root-hierarchy-for-dv-tls-issuance-42783