Signing back into the Community for the first time? You'll need to reset your password to access your account.  Find out more.

Forum Discussion

integralist's avatar
integralist
New Contributor
2 months ago

How to extract a

👋

I have the following script which attempts to extract a p12 from my 1Password vault:

op item get "EXAMPLE" --vault "EXAMPLE" --format json | \
    jq '.files[] | select(.name == "EXAMPLE.p12") | .content_path' | \
    cut -d / -f 6 | \
    xargs -I % op document get % > /tmp/EXAMPLE.p12

It sort of works, but not really because when it extracts the p12 it actually converts it into a PEM (where as the p12 actually contains both a PEM and private key).

For example, this is the original file (it's a binary format):

$ file ~/Downloads/EXAMPLE.p12
~/Downloads/EXAMPLE.p12: data

And here is the extracted version:

$ file /tmp/EXAMPLE.p12
/tmp/EXAMPLE.p12: PEM certificate

The structure of this particular item in 1Password is like this:

$ op item get "EXAMPLE" --vault "EXAMPLE" --format json | jq '.files[]'

{
    "id": "REDACTED",
    "name": "EXAMPLE.p12",
    "size": 6818,
    "content_path": "/v1/vaults/REDACTED/items/REDACTED/files/REDACTED/content",
    "section": {
        "id": "REDACTED",
        "label": "EXAMPLE"
    }
}

Does anyone know the correct way to extract a p12 file (as currently 1Password is choosing to extract only the PEM part of it and not the private key)?

Thanks

macos
  • integralist's avatar
    integralist
    New Contributor
    31 days ago

    I spoke with 1Password support and they suggested I don't use `document get` but `op read` with `attribute=content` and specifying the section ID where the file is attached...

    VAULT_ID=$(op item get "EXAMPLE" --vault "EXAMPLE" --format json | jq -r '.id')

SECTION_ID=$(op item get "EXAMPLE" --vault "EXAMPLE" --format json | jq -r '.sections[] | select(.label == "EXAMPLE") | .id')

op read --out-file /tmp/EXAMPLE.p12 "op://EXAMPLE/$VAULT_ID/$SECTION_ID/EXAMPLE.p12?attribute=content"