Download

Convert PEM to PFX without OpenSSL

A PFX file, also called PKCS #12 or .p12, holds a certificate and its private key in one password-protected file. It is the format Windows, IIS and many appliances ask for. This guide builds one from PEM files with CertConvert, entirely on your own machine.

What you need

  • The certificate as a PEM file, usually .pem or .crt.
  • The private key that belongs to it. PKCS #8, PKCS #1 and SEC 1 keys all work, encrypted or not.
  • A password to protect the new PFX.

CertConvert reads the format from the file’s content, so a mislabelled extension does not matter.

In the app

  1. Open the Convert view and drag in the certificate, or choose Add Files….
  2. Choose Add Key File… and pick the private key. If the key is encrypted, type its passphrase in Key Password.
  3. Set Target format to PKCS #12 (.pfx).
  4. Type the password for the new file in PFX Password.
  5. Choose Convert And Save… and pick where to save it.

CertConvert checks that the key belongs to the certificate before it writes anything. If they do not match, it stops and tells you instead of producing a PFX that will fail later.

To include the intermediate and root certificates in the right order, build the PFX from the Chain view instead. See fix certificate chain order.

From the command line

The command line is part of a copy built from source. The Mac App Store and Microsoft Store editions are the graphical app only. Build from source to use these commands.
certconvert convert device.pem --key device.key -o device.pfx --out-password secret

# the key is encrypted
certconvert convert device.pem --key device.key --key-password keypass \
            -o device.pfx --out-password secret

# check the result
certconvert inspect device.pfx --password secret

The output format is taken from the .pfx or .p12 extension, or from --to pfx.

A password typed on the command line is saved in your shell history and can be seen by other processes while the command runs. The command line has no other way to take one, and deleting the history line afterwards does not undo that exposure. For a password that matters, use the app.

The OpenSSL equivalent

For comparison, the same job in OpenSSL is:

openssl pkcs12 -export -in device.pem -inkey device.key -out device.pfx

CertConvert does this without a shell, and it verifies the key match first.

OpenSSL is named here for comparison only. See trademarks.

Common snags

“The private key does not match any certificate being exported”

The key and certificate are not a pair. Open the Keys view, load the key, choose the certificate and use Check Match to find the right one.

An older system rejects the PFX

By default the PFX is encrypted with AES-256 and SHA-256. Some older importers only understand the legacy scheme. Tick Legacy Ciphers (Old Importers), or pass --legacy, to write 3DES and SHA-1 instead.

The PFX has an empty password

CertConvert will write a PFX with no password, but it warns you. Many importers refuse such a file, and the private key inside is unprotected.

.pfx or .p12?

They are the same format. Use whichever extension the destination expects.

CertConvert runs on macOS and Windows and never uploads your certificates or keys. Download CertConvert.