DevTransformFREE
Zero-Upload • 100% Client-Side
OpenSSL • Format Conversions

How to Convert PFX / PKCS#12 to PEM Certificate and Private Key

PKCS#12 (.pfx or .p12) is the standard format used by Microsoft Windows and IIS to store certificates alongside private keys and CA chains. Linux web servers like NGINX require separate PEM files (`.crt` and `.key`).

Convert PFX / PKCS#12 to PEM Command
Caution • Private Key Handling / Decryption
openssl pkcs12 -in bundle.pfx -nocerts -out key.pem -nodes && openssl pkcs12 -in bundle.pfx -clcerts -nokeys -out cert.pem
Customize:
Domain:
Cert File:

OpenSSL Flags & Options Explained

-in bundle.pfxInput PKCS#12 archive file
-nocertsExtracts only the private key, skipping certificates
-clcertsExtracts only client/server certificate, skipping CA chain
-cacertsExtracts intermediate and root CA certificates
-nodesExtracts private key without setting an output passphrase

Execution Steps & Verification

1Extract the private key

Extract unencrypted private key to key.pem:

openssl pkcs12 -in bundle.pfx -nocerts -out key.pem -nodes
2Extract the primary SSL certificate

Extract public server certificate to cert.pem:

openssl pkcs12 -in bundle.pfx -clcerts -nokeys -out cert.pem
3Extract the intermediate CA chain bundle

Extract intermediate certificates for full SSL chain validation:

openssl pkcs12 -in bundle.pfx -cacerts -nokeys -out chain.pem

Common Security Pitfalls & Solutions

  • In OpenSSL 3.0, older PFX files created with legacy algorithms (RC2/3DES) will fail with "error:0308010C:digital envelope routines::unsupported". Fix by appending the `-legacy` flag: `openssl pkcs12 -legacy -in bundle.pfx ...`.

Prerequisites & Environment

  • Valid .pfx or .p12 archive and its export password.

Frequently Asked Questions About Convert PFX / PKCS#12 to PEM

Frequently Asked Questions

Frequently Asked Questions

Everything you need to know regarding specifications, syntax, and security best practices.

They are virtually identical file formats implementing the PKCS#12 standard. .pfx was originally created by Microsoft, while .p12 is the official IETF standard.

Related OpenSSL & Security Commands

View All Recipes
Generation & Keys

How to Generate a Self-Signed SSL Certificate with OpenSSL

reqGuide →
Verification & Inspection

How to Check SSL Certificate Expiration Date from Domain or File

s_clientGuide →
Verification & Inspection

How to View and Inspect SSL Certificate Details (Subject, Issuer, SAN)

x509Guide →
Verification & Inspection

How to Verify Private Key Matches SSL Certificate (Modulus MD5 Check)

x509Guide →
Generation & Keys

How to Generate a Certificate Signing Request (CSR) with SAN

reqGuide →
Format Conversions

How to Convert CRT, CER or DER to PEM Format

x509Guide →