PFX to PEM converter

The PFX to PEM converter splits a PFX/P12 file into PEM files. Choose the .pfx or .p12, enter its password and press Convert. You get fullchain.pem for Nginx and Apache, the separate leaf and chain files, and the private key, all decrypted in your browser.

When you need PEM from a PFX

• Moving a certificate from Windows/IIS to Linux servers (Nginx, Apache, HAProxy).
• Cloud downloads for IIS or Tomcat arrive as PFX, but the server you use wants PEM.
• Uploading to a CDN or load balancer that asks for a certificate body, chain and private key in PEM.

Steps

1. Choose the PFX file.
2. Enter the password (leave empty if it was exported without one).
3. Press Convert and download the files you need: - fullchain.pem: leaf + intermediates, for ssl_certificate (Nginx) or SSLCertificateFile (Apache 2.4.8+); - cert.pem and chain.pem: separately, for software that wants them apart; - privkey.pem: the private key in PKCS #8.

Equivalent OpenSSL commands

openssl pkcs12 -in example.pfx -clcerts -nokeys -out cert.pem
openssl pkcs12 -in example.pfx -cacerts -nokeys -out chain.pem
openssl pkcs12 -in example.pfx -nocerts -nodes -out privkey.pem
# OpenSSL 3 with an old RC2-encrypted PFX: add -legacy to each command

Common errors

• Wrong password: the MAC check failed. PFX passwords are case-sensitive; files exported from some tools use an empty password.
• Root certificate included: roots are left out of chain.pem because servers do not need to send them.
• Several keys in one file: each is offered separately; use the key matcher to see which belongs to the certificate.