---
title: "PKCS"
url: https://getstell.com/glossary/pkcs-12
description: "A password-protected file bundling a certificate and its private key, the format signing certificates and NFC keys usually travel in."
---

# PKCS

PKCS #12 is a container format, usually seen as a `.p12` or `.pfx` file: one password-protected bundle holding an [X.509 certificate](/glossary/x509-certificate) together with the private key that belongs to it. The two are useless apart, a certificate is public, the key must stay secret, so PKCS #12 exists to move them as a matched, encrypted pair.

In wallet pass work, `.p12` files appear wherever signing identity changes hands. A Pass Type ID certificate exported from Apple's developer portal through the macOS Keychain comes out as a `.p12`; whoever holds it, plus its password, can sign passes for that [pass type identifier](/glossary/pass-type-identifier). NFC encryption keys follow the same pattern: configuring a payment terminal or reader to decrypt taps from a pass means handing the acquirer or reader the private key, often delivered as a `.p12` or extracted from one.

Two practical things follow. First, a `.p12` is a credential, not a document: it should move through a secrets channel, never email or chat, and the password travels separately. Second, the certificates inside expire, Apple's pass signing certificates yearly, so the `.p12` a program was set up with is not the one it runs on forever.

A platform's job is to make this someone else's problem. Stell holds and renews signing certificates, and exposes exactly the pieces an integration needs, such as the terminal encryption key in the portal, so a merchant never handles a `.p12` to run a program. The format is worth recognizing mainly so the setup emails from acquirers and hardware vendors make sense.