# PFX to PEM Converter: Extract Key, Certificate and Chain

> Convert .pfx or .p12 to PEM in your browser: fullchain.pem, cert.pem, chain.pem and the private key. Reads AES and legacy RC2/3DES.

Source: https://ssl.sh/tools/ssl-converter/pfx-to-pem/
Last updated: 2026-11-10

Unpack a .pfx/.p12 file into PEM: certificate, intermediate chain, full chain and private key, ready for Nginx or Apache.

The PFX to PEM converter splits a PFX/P12 file into PEM files. Choose the `.pfx` or `.p12`, enter its password and press **Convert**. You get `fullchain.pem` for Nginx and Apache, the separate leaf and chain files, and the private key, all decrypted in your browser.

## When you need PEM from a PFX

- Moving a certificate from Windows/IIS to Linux servers (Nginx, Apache, HAProxy).
- Cloud downloads for IIS or Tomcat arrive as PFX, but the server you use wants PEM.
- Uploading to a CDN or load balancer that asks for a certificate body, chain and private key in PEM.

## Steps

1. Choose the PFX file.
2. Enter the password (leave empty if it was exported without one).
3. Press **Convert** and download the files you need:
   - `fullchain.pem`: leaf + intermediates, for `ssl_certificate` (Nginx) or `SSLCertificateFile` (Apache 2.4.8+);
   - `cert.pem` and `chain.pem`: separately, for software that wants them apart;
   - `privkey.pem`: the private key in PKCS #8.

## Equivalent OpenSSL commands

```bash
openssl pkcs12 -in example.pfx -clcerts -nokeys -out cert.pem
openssl pkcs12 -in example.pfx -cacerts -nokeys -out chain.pem
openssl pkcs12 -in example.pfx -nocerts -nodes -out privkey.pem
# OpenSSL 3 with an old RC2-encrypted PFX: add -legacy to each command
```

## Common errors

- **Wrong password**: the MAC check failed. PFX passwords are case-sensitive; files exported from some tools use an empty password.
- **Root certificate included**: roots are left out of `chain.pem` because servers do not need to send them.
- **Several keys in one file**: each is offered separately; use the [key matcher](https://ssl.sh/tools/key-matcher/) to see which belongs to the certificate.


## FAQ

**Why does OpenSSL 3 fail with 'unsupported' on my PFX?**

The file uses RC2-40, which OpenSSL 3 only offers through the legacy provider. Add -legacy to the openssl pkcs12 command, or use this converter, which reads RC2 and 3DES files directly.

**Is the extracted private key encrypted?**

No. Web servers such as Nginx need an unencrypted key file. Store it with restrictive permissions (chmod 600) and delete temporary copies.

**The PFX contains no chain. What now?**

Some exports include only the leaf. Get the intermediates from your CA or build the chain from the live server with the chain builder.