PFX (Personal Information Exchange (.pfx))

A .pfx file is a PKCS #12 archive under the extension Microsoft uses. The name comes from Personal Information Exchange, a Microsoft format that evolved into PKCS #12; today .pfx and .p12 files have the same structure. On Windows, the Certificate Export Wizard offers "Personal Information Exchange - PKCS #12 (.PFX)" as the option that includes the private key, and IIS, Exchange and many other Windows services import certificates from .pfx files.

Why it matters

Windows keeps private keys in its own key storage, so a .pfx export is how you back up a server certificate, move it to another IIS server or load balancer, or hand it to a service that needs key and certificate together. The private key must have been marked exportable when it was created or imported; otherwise the PFX option is greyed out. Moving a .pfx to Linux servers means extracting a PEM certificate chain and a separate key file.

Example

$pw = Read-Host -AsSecureString
Import-PfxCertificate -FilePath C:\certs\example.com.pfx `
  -CertStoreLocation Cert:\LocalMachine\My -Password $pw

openssl pkcs12 -in example.com.pfx -clcerts -nokeys -out example.com.crt
openssl pkcs12 -in example.com.pfx -cacerts -nokeys -out chain.pem
cat example.com.crt chain.pem > fullchain.pem
openssl pkcs12 -in example.com.pfx -nocerts -nodes -out example.com.key

Common misconceptions

• PFX and PKCS #12 are different formats. Modern .pfx files are PKCS #12.
• A greyed-out export option means the certificate is broken. It means the private key is missing on that machine or marked non-exportable.
• nginx can load a .pfx file directly. nginx needs PEM files; split the .pfx into a fullchain certificate file and a key file first.