Change-pfx-password.sh

#!/usr/bin/env bash
#
#
#   PURPOSE/NOTES
#     Write a new PFX file with a new password.
#
#   REVISIONS:
#   Ver        Date        Author           Description
#
#   1.0        2026.08.25  CEGAL.DK/amg     created
#   1.1        2026.08.25  CEGAL.DK/amg     added optional current password argument
#

##set -x
set -euo pipefail

VERSION='1.1'

usage() {
  printf 'Script %s has version %s\n' "${0##*/}" "$VERSION" >&2
  printf 'Usage: %s -i input.pfx [-p current-password] [-o output.pfx]\n' "${0##*/}" >&2
  printf '\nSet STANDARD_PASSPHRASE in the environment for the replacement password.\n' >&2
  printf 'If -p is omitted, the current password is read from masked stdin.\n' >&2
  exit 2
}

input=''
output=''
current_password=''
while getopts ':i:o:p:h' option; do
  case "$option" in
    i) input=$OPTARG ;;
    o) output=$OPTARG ;;
    p) current_password=$OPTARG ;;
    h) usage ;;
    *) usage ;;
  esac
done

[[ -n "$input" ]] || usage
[[ -f "$input" ]] || { printf 'Input file not found: %s\n' "$input" >&2; exit 1; }
[[ -n "$output" ]] || output="${input%.pfx}_STD.pfx"
[[ -n "${STANDARD_PASSPHRASE:-}" ]] || {
  printf 'STANDARD_PASSPHRASE is not set.\n' >&2
  printf 'I.e.: export STANDARD_PASSPHRASE='\''your_password'\''\n' >&2
  exit 1
}

password_file=$(mktemp)
cleanup() {
  rm -f "$password_file"
}
trap cleanup EXIT
chmod 600 "$password_file"

if [[ -z "$current_password" ]]; then
  printf 'Enter the current PFX password: ' >&2
  IFS= read -r -s current_password
  printf '\n' >&2
fi
printf '%s' "$current_password" > "$password_file"

openssl pkcs12 \
  -in "$input" \
  -passin "file:$password_file" \
  -nodes \
  | openssl pkcs12 \
      -export \
      -out "$output" \
      -passout "env:STANDARD_PASSPHRASE"

printf 'Created %s\n' "$output"