PEM to PFX converter

The PEM to PFX converter bundles a certificate, its chain and the private key into one password-protected PFX (P12, PKCS #12) file. Paste the certificate, the key and, optionally, the chain, set a password and press Create PFX. The tool checks that the key matches the certificate and orders the chain. The private key stays in your browser.

When you need a PFX

• IIS and Windows Server: the certificate import wizard and Import-PfxCertificate expect PFX.
• Azure App Service, Azure Key Vault: certificate upload takes PFX.
• Exchange, RDP, ADFS and other Windows services.
• Java and Tomcat: PKCS #12 has been the default keystore type since Java 9 and can be used directly as certificateKeystoreFile.

Steps

1. Paste the certificate. If your CA sent a bundle, paste it all: leaf first or not, the tool finds the leaf by matching the key.
2. Paste the private key (BEGIN PRIVATE KEY, BEGIN RSA PRIVATE KEY or BEGIN EC PRIVATE KEY). For an encrypted key enter its password.
3. Set the PFX password twice and, optionally, a friendly name shown in the Windows certificate store.
4. Tick compatibility mode only for old systems, then press Create PFX.

Equivalent OpenSSL commands

# OpenSSL 3 default: AES-256-CBC, PBKDF2, HMAC-SHA256
openssl pkcs12 -export -out example.com.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem -name example.com
# compatibility mode for Windows Server 2016 / Java 8
openssl pkcs12 -export -out example.com.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem \
  -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -macalg sha1

Common errors

• "The private key does not belong to any of the certificates": the key is from another CSR. Find the right key with the key matcher.
• Windows says the password is incorrect although it is right: the system cannot read AES-encrypted PFX files. Rebuild with compatibility mode.
• The site shows an incomplete chain after import: the intermediates were missing from the PFX, or Windows already had an outdated intermediate. Include the chain and re-import.