# What Is PFX (Personal Information Exchange (.pfx))?

> PFX is the .pfx file that Windows and IIS use to import and export a certificate with its private key and chain, stored in PKCS #12 format.

Source: https://ssl.sh/glossary/pfx/
Last updated: 2026-11-10

A .pfx file is a [PKCS #12](https://ssl.sh/glossary/pkcs12/) archive under the extension Microsoft uses. The name comes from Personal Information Exchange, a Microsoft format that evolved into PKCS #12; today .pfx and .p12 files have the same structure. On Windows, the Certificate Export Wizard offers "Personal Information Exchange - PKCS #12 (.PFX)" as the option that includes the [private key](https://ssl.sh/glossary/private-key/), and IIS, Exchange and many other Windows services import certificates from .pfx files.

## Why it matters
Windows keeps private keys in its own key storage, so a .pfx export is how you back up a server certificate, move it to another IIS server or load balancer, or hand it to a service that needs key and certificate together. The private key must have been marked exportable when it was created or imported; otherwise the PFX option is greyed out. Moving a .pfx to Linux servers means extracting a PEM certificate chain and a separate key file.

## Example
```powershell
$pw = Read-Host -AsSecureString
Import-PfxCertificate -FilePath C:\certs\example.com.pfx `
  -CertStoreLocation Cert:\LocalMachine\My -Password $pw
```

```bash
openssl pkcs12 -in example.com.pfx -clcerts -nokeys -out example.com.crt
openssl pkcs12 -in example.com.pfx -cacerts -nokeys -out chain.pem
cat example.com.crt chain.pem > fullchain.pem
openssl pkcs12 -in example.com.pfx -nocerts -nodes -out example.com.key
```

## Common misconceptions
- **PFX and PKCS #12 are different formats.** Modern .pfx files are PKCS #12.
- **A greyed-out export option means the certificate is broken.** It means the private key is missing on that machine or marked non-exportable.
- **nginx can load a .pfx file directly.** nginx needs PEM files; split the .pfx into a [fullchain](https://ssl.sh/glossary/fullchain/) certificate file and a key file first.

## Related terms

- [PKCS#12](https://ssl.sh/zh/glossary/pkcs12/): PKCS#12 是一种用口令保护的二进制容器格式，可以把私钥、证书和证书链打包进一个文件，扩展名通常是 .p12 或 .pfx。
- [私钥](https://ssl.sh/zh/glossary/private-key/): 私钥是非对称密钥对中保密的那一半，TLS 服务器用它证明自己拥有证书里的那把公钥。
- [CRT 文件](https://ssl.sh/zh/glossary/crt-file/): CRT 文件是存放 X.509 证书的 .crt 或 .cer 文件，内容可能是 PEM 文本，也可能是二进制 DER，取决于生成它的平台。
- [PEM](https://ssl.sh/zh/glossary/pem/): PEM 是一种把 DER 二进制数据做 Base64 编码、再用 BEGIN 和 END 行包起来的文本格式，是存放证书和私钥最常见的方式。
- [KEY 文件](https://ssl.sh/zh/glossary/key-file/): KEY 文件是按惯例存放私钥的 .key 文件，通常为 PEM 编码，但扩展名本身并不说明里面的具体格式。
- [证书链](https://ssl.sh/zh/glossary/certificate-chain/): 证书链是从网站终端证书经中间证书一直到受信任根证书的有序证书序列，每一张都由下一张签名。
- [fullchain](https://ssl.sh/zh/glossary/fullchain/): fullchain 是依次包含站点证书和中间证书的 PEM 文件，让客户端能把站点证书连到受信任的根证书。