Download

Convert PFX to PEM and extract the private key

Web servers such as nginx and Apache want the certificate and the private key as separate PEM files, but a certificate exported from Windows arrives as one .pfx. This guide takes a PFX apart with CertConvert, without sending the key anywhere.

What you need

  • The .pfx or .p12 file.
  • Its password.

A PFX holds two things, so there are two short steps: the certificates, then the key.

Step 1: extract the certificates

  1. Open the Convert view and drag in the PFX, or choose Add Files….
  2. Type the PFX password in Input Password (If Needed).
  3. Set Target format to PEM Certificate (.pem).
  4. Choose Convert And Save….

The PEM file contains every certificate in the PFX and no private key.

Step 2: extract the private key

  1. Open the Keys view and choose Open Key…, then pick the same PFX.
  2. Type the PFX password in Key Password (If Needed) and choose Unlock.
  3. Under Convert format, choose PKCS #8 PEM (Unencrypted), or PKCS #8 PEM (Encrypted, AES-256) and set a New Password.
  4. Choose Save Converted Key….
An unencrypted key file can be used by anyone who can read it. Prefer the encrypted option where the destination supports it, and restrict the file’s permissions either way.

From the command line

The command line is part of a copy built from source. The Mac App Store and Microsoft Store editions are the graphical app only. Build from source to use these commands.
# certificates only
certconvert convert device.pfx --password secret -o device.pem

# the private key, unencrypted PKCS #8
certconvert key convert device.pfx --password secret -o device.key

# the private key, encrypted with a new passphrase
certconvert key convert device.pfx --password secret -o device-encrypted.key \
            --to pkcs8-enc --out-password newsecret

# confirm the certificate and the unencrypted key are a pair
certconvert key match --cert device.pem --key device.key
A password typed on the command line is saved in your shell history and can be seen by other processes while the command runs. The command line has no other way to take one, and deleting the history line afterwards does not undo that exposure. For a password that matters, use the app.

For a server that wants a traditional RSA key, use --to pkcs1. For an EC key in SEC 1 form, use --to sec1.

The OpenSSL equivalent

For comparison, the same job in OpenSSL takes two commands:

openssl pkcs12 -in device.pfx -nokeys -out device.pem
openssl pkcs12 -in device.pfx -nocerts -nodes -out device.key

OpenSSL 3 spells -nodes as -noenc; the older flag still works there.

OpenSSL is named here for comparison only. See trademarks.

Common snags

“…is password-protected”

The PFX needs its password. Type it in the password field in the app, or pass --password on the command line.

The PEM holds more than one certificate

The PFX carried a chain. That is normal. To check or correct the order, see fix certificate chain order.

Which key format does my server need?

PKCS #8, which starts -----BEGIN PRIVATE KEY-----, works almost everywhere. Older software may want PKCS #1, which starts -----BEGIN RSA PRIVATE KEY-----. The Keys view converts between them.

CertConvert runs on macOS and Windows and never uploads your certificates or keys. Download CertConvert.