How to Convert an SSL Certificate to PFX (PKCS 12) with OpenSSL

Applies to: OpenSSL 3 on Linux, macOS and Windows; PFX files for IIS, Windows Server and Azure

Windows servers (IIS, Exchange, Remote Desktop) and some cloud services import certificates as a single .pfx file (also called PKCS#12 or .p12). It contains the certificate, its private key and the intermediate certificates, protected by a password. Certificate authorities usually send PEM files (.crt, .cer, .key), so you combine them with OpenSSL. We tested every command with OpenSSL 3.5.

You need

• example.crt: your certificate.
• example.key: the private key created with the certificate request (CSR).
• ca-bundle.crt: the intermediate certificates from your certificate authority.

Create the PFX

openssl pkcs12 -export -out example.pfx -inkey example.key -in example.crt -certfile ca-bundle.crt

OpenSSL asks for an export password; you need it when importing. Check the file:

openssl pkcs12 -in example.pfx -info -noout

For older Windows versions

OpenSSL 3 protects PFX files with AES-256 and SHA-256 by default, which older Windows versions can’t import (the import fails with a password error). Create a compatible file instead:

openssl pkcs12 -export -certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES -macalg sha1 \
  -out example.pfx -inkey example.key -in example.crt -certfile ca-bundle.crt

Does the key belong to the certificate?

openssl x509 -noout -pubkey -in example.crt | sha256sum
openssl pkey -pubout -in example.key | sha256sum

Both lines must be identical. If they differ, the key belongs to another request and the PFX won’t work.

PFX back to PEM files

openssl pkcs12 -in example.pfx -clcerts -nokeys -out example.crt
openssl pkcs12 -in example.pfx -nocerts -nodes -out example.key
openssl pkcs12 -in example.pfx -cacerts -nokeys -out ca-bundle.crt

-nodes saves the key without a password, so protect the file (chmod 600 example.key).

Import on Windows

Double-click the PFX and follow the Certificate Import Wizard (store: Local Machine, Personal), or in IIS Manager open Server Certificates and click Import. Then bind the certificate to your site on port 443.

Need a certificate? See our SSL certificates.