poka.sh

 Docs

P12

Generated by scripts/gen-format-pages.py from docs/data/format-metadata/, FILE_FORMATS.csv and docs/formats-master.csv. Do not edit by hand: change the source, then run the script.

PKCS#12 Keystore Preview.

At a glance
Purpose A PKCS#12 (PFX) keystore: certificates and private keys in safe bags, usually password-encrypted, with a MAC.
Extensions .p12
Poka parser poka-p12
Viewer poka-tree-viewer
Depth tier Parser with a shared viewer (see Depth tiers)
Breadth tier B3 Core (see Breadth tiers)

How much Poka reads

B3 Core. Only the main content type or types are decoded (for example geometry but not materials, layers or annotations, or only one version family). The list of gaps is substantial.

Confidence: high (the reviewer read the code and a test that proves the claim). Basis: Reviewed 2026-10-26: read parsers/poka-p12/src/main.rs (1024 lines) and plugin.json. Four unit tests, including corpus_keystore_reports_encrypted_content over the corpus keystore, and a generated keystore whose certificates are decoded. Covers .p12 and .pfx. The tree shows the version, encoding and MAC (algorithm, iterations, salt), the authenticated-safe sections, and every bag: unencrypted certificate bags are decoded (subject, issuer, expiry, serial), key, CRL and secret bags are counted by type, and password-encrypted sections are counted without being opened. Judgement: B3: unencrypted content is decoded, but most real keystores encrypt their certificates and keys, which are never opened.

What Poka does not read

  • Password-encrypted sections, which hold the certificates and keys of most real keystores, are not decrypted (by design: no password is tried)
  • Private keys are counted, never decoded
  • Bag attributes (friendly name, local key ID) are not shown (judgement from the code)
  • The MAC is not verified

Libraries

Libraries Poka uses or has assessed for this format, with the status, licence and language the registry records.

  • der-parser (used; MIT OR Apache-2.0; Rust)
  • x509-parser (used; MIT OR Apache-2.0; Rust)
  • p12-keystore (candidate; MIT OR Apache-2.0; Rust; https://github.com/ancwrd1/p12-keystore) — High-level PKCS#12 reader/writer, Java KeyStore style; no MD5-based schemes or unencrypted stores.
  • pkcs12 (RustCrypto) (candidate; Apache-2.0 OR MIT; Rust; https://lib.rs/crates/pkcs12) — Pure Rust PKCS#12 (RFC 7292) implementation; page does not list parsing functions; latest is a pre-release.

Sources

  • parsers/poka-p12/src/main.rs
  • parsers/poka-p12/plugin.json