# PEM to PFX Converter (P12): Bundle Certificate and Key

> Combine a PEM certificate, chain and private key into a password-protected PFX/P12 in your browser, for IIS, Windows, Azure and Java.

Source: https://ssl.sh/tools/ssl-converter/pem-to-pfx/
Last updated: 2026-11-10

Bundle a PEM certificate, its chain and private key into one password-protected .pfx/.p12 file. Runs in your browser.

The PEM to PFX converter bundles a certificate, its chain and the private key into one password-protected PFX (P12, PKCS #12) file. Paste the certificate, the key and, optionally, the chain, set a password and press **Create PFX**. The tool checks that the key matches the certificate and orders the chain. The private key stays in your browser.

## When you need a PFX

- **IIS and Windows Server**: the certificate import wizard and `Import-PfxCertificate` expect PFX.
- **Azure App Service, Azure Key Vault**: certificate upload takes PFX.
- **Exchange, RDP, ADFS** and other Windows services.
- **Java and Tomcat**: PKCS #12 has been the default keystore type since Java 9 and can be used directly as `certificateKeystoreFile`.

## Steps

1. Paste the certificate. If your CA sent a bundle, paste it all: leaf first or not, the tool finds the leaf by matching the key.
2. Paste the private key (`BEGIN PRIVATE KEY`, `BEGIN RSA PRIVATE KEY` or `BEGIN EC PRIVATE KEY`). For an encrypted key enter its password.
3. Set the PFX password twice and, optionally, a friendly name shown in the Windows certificate store.
4. Tick compatibility mode only for old systems, then press **Create PFX**.

## Equivalent OpenSSL commands

```bash
# OpenSSL 3 default: AES-256-CBC, PBKDF2, HMAC-SHA256
openssl pkcs12 -export -out example.com.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem -name example.com
# compatibility mode for Windows Server 2016 / Java 8
openssl pkcs12 -export -out example.com.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem \
  -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -macalg sha1
```

## Common errors

- **"The private key does not belong to any of the certificates"**: the key is from another CSR. Find the right key with the [key matcher](https://ssl.sh/tools/key-matcher/).
- **Windows says the password is incorrect** although it is right: the system cannot read AES-encrypted PFX files. Rebuild with compatibility mode.
- **The site shows an incomplete chain after import**: the intermediates were missing from the PFX, or Windows already had an outdated intermediate. Include the chain and re-import.


## FAQ

**Which encryption should I choose?**

Use the default (AES-256, HMAC-SHA256) for Windows Server 2019 and later, current macOS and Java 11+. Choose compatibility mode (3DES, SHA-1 MAC) only if an older system reports a wrong password or refuses the file.

**Should the root certificate go into the PFX?**

It is not needed for servers: clients have the root already. Include the leaf and intermediates. Some import wizards accept the root as well, but it adds nothing to the TLS handshake.

**Can I create a PFX without a password?**

Technically yes, and Windows can import it, but anyone who gets the file then has your private key. Always set a password when the file leaves the server.