Convert PFX to PEM (and back)

The formats

• PFX / P12 (PKCS#12): a password-protected container with certificate, intermediates and private key. Standard on Windows, IIS, Exchange and Azure.
• PEM: text files with blocks such as -----BEGIN CERTIFICATE-----. Standard on Linux, nginx, Apache and HAProxy. The extensions .pem, .crt, .cer and .key are often PEM.
• DER: the same as PEM, but binary. On Windows .cer is often DER.
• P7B (PKCS#7): certificates only, no key, often delivered by the CA as the chain.

Without OpenSSL: convert in the browser

Drop the PFX file into the certificate converter and enter the password. Certificate, chain and key can then be downloaded separately or as a bundle. The other way round, the converter takes certificate and key as PEM and builds a PFX, completing missing intermediates automatically. Everything runs in your browser.

PFX → PEM with OpenSSL

# everything in one file (key unencrypted)
openssl pkcs12 -in file.pfx -out all.pem -nodes

# server certificate only
openssl pkcs12 -in file.pfx -clcerts -nokeys -out server.crt

# intermediates only
openssl pkcs12 -in file.pfx -cacerts -nokeys -out chain.crt

# private key only
openssl pkcs12 -in file.pfx -nocerts -nodes -out server.key

“unsupported” error with OpenSSL 3

error:0308010C:digital envelope routines::unsupported

Older PFX files are encrypted with RC2 or 3DES. OpenSSL 3 only loads these algorithms in legacy mode. The fix is the -legacy switch:

openssl pkcs12 -legacy -in old.pfx -out all.pem -nodes

PEM → PFX with OpenSSL

openssl pkcs12 -export -out server.pfx \
  -inkey server.key -in server.crt -certfile chain.crt

Windows says “The password you entered is incorrect”

OpenSSL 3 encrypts PFX with AES-256 by default. Windows Server 2016 and older cannot open that and report a wrong password although it is correct. Files created with 3DES work everywhere:

openssl pkcs12 -export -out server.pfx -inkey server.key -in server.crt -certfile chain.crt \
  -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -macalg sha1

The certificate converter creates PFX files with 3DES from the start and reads both AES and older RC2 files.

Which format for which server?

• nginx: PEM: ssl_certificate with server certificate and chain in one file, ssl_certificate_key with the key.
• Apache 2.4.8+: PEM: SSLCertificateFile with certificate and chain, SSLCertificateKeyFile with the key.
• HAProxy: a single PEM file with certificate, chain and key.
• IIS, Exchange, Windows services: PFX.
• Tomcat and Java 9+: PKCS#12 directly as keystore (keystoreType="PKCS12").