Private Key changes between exports from a .PFX (PKCS#12) File

Question

I am Exporting only the private key(s) from a .pfx file to a .pem (.key) file:

I am using the command as below.....I executed the command twice to generate the private key twice (It asks me for a import password and a PEM pass phrase each time) in two different physical files

openssl pkcs12 -nocerts -in DigitalCertificateExport.pfx -out OnlyKey_SameParaPhrase_1.key openssl pkcs12 -nocerts -in DigitalCertificateExport.pfx -out OnlyKey_SameParaPhrase_2.key

However, the resulting key file has different private key each time. Should it not be the same always? I was expecting it to be the same each time.

Worth mentioning that I provide exactly the same pass phrase each time.

Answer 1

According to this OpenSSL doc, at least some encryption methods for .pem files use a random salt. When using your command to convert a .pfx file I get a file with the following line:

-DEK-Info: DES-EDE3-CBC,6AC8DB439F2BDE03

This cointains a random salt used for encryption and / or validation.