# What Is PKCS #12? Definition and Examples

> PKCS #12 is a password-protected binary container format that bundles a private key with its certificate and chain in one file, usually .p12 or .pfx.

Source: https://ssl.sh/glossary/pkcs12/
Last updated: 2026-11-10

PKCS #12, specified in [RFC 7292](https://www.rfc-editor.org/rfc/rfc7292), defines an archive that can hold private keys, certificates and CA certificates in a single DER-encoded file, with integrity protection and encryption derived from a password. It is the standard way to move a complete identity, a key plus its [certificate chain](https://ssl.sh/glossary/certificate-chain/), between systems, and the native import and export format of Windows, macOS Keychain, browsers and Java, which has used PKCS #12 as its default keystore type since Java 9.

## Why it matters
Whenever a server or client needs the key and certificate together, PKCS #12 avoids juggling separate files, and the password gives some protection in transit. The algorithms inside matter for compatibility: OpenSSL 3.x creates files with AES-256 and PBKDF2 by default, while some older systems only understand the legacy RC2/3DES-based format, which OpenSSL produces with the `-legacy` option. See [PFX](https://ssl.sh/glossary/pfx/) for the Windows and IIS side of the same format.

## Example
```bash
openssl pkcs12 -export -inkey example.com.key -in example.com.crt \
  -certfile chain.pem -name example.com -out example.com.p12
openssl pkcs12 -in example.com.p12 -info -noout
openssl pkcs12 -in example.com.p12 -nodes -out example.com-all.pem
```

## Common misconceptions
- **.p12 and .pfx are different formats.** They are the same PKCS #12 structure with different customary extensions.
- **The password makes the file safe to email.** Weak passwords can be brute-forced offline; treat the file like a bare [private key](https://ssl.sh/glossary/private-key/).
- **An import failure always means a wrong password.** It can also mean the importing system does not support the encryption algorithm used in the file.

## Related terms

- [PFX](https://ssl.sh/zh/glossary/pfx/): PFX 是 Windows 和 IIS 用来导入导出证书及其私钥、证书链的 .pfx 文件，格式就是 PKCS#12。
- [PEM](https://ssl.sh/zh/glossary/pem/): PEM 是一种把 DER 二进制数据做 Base64 编码、再用 BEGIN 和 END 行包起来的文本格式，是存放证书和私钥最常见的方式。
- [私钥](https://ssl.sh/zh/glossary/private-key/): 私钥是非对称密钥对中保密的那一半，TLS 服务器用它证明自己拥有证书里的那把公钥。
- [JKS](https://ssl.sh/zh/glossary/jks/): JKS 是 Java 早期默认的专有密钥库文件格式，用来存放私钥、证书链和受信任证书，通过 keytool 管理。
- [KEY 文件](https://ssl.sh/zh/glossary/key-file/): KEY 文件是按惯例存放私钥的 .key 文件，通常为 PEM 编码，但扩展名本身并不说明里面的具体格式。
- [CRT 文件](https://ssl.sh/zh/glossary/crt-file/): CRT 文件是存放 X.509 证书的 .crt 或 .cer 文件，内容可能是 PEM 文本，也可能是二进制 DER，取决于生成它的平台。
- [证书链](https://ssl.sh/zh/glossary/certificate-chain/): 证书链是从网站终端证书经中间证书一直到受信任根证书的有序证书序列，每一张都由下一张签名。