PFX · P12 Converter
Open a .pfx or .p12 file and save its certificate, chain and private key as PEM files, or build a PFX from PEM, CRT and KEY files. Also converts old PFX files that OpenSSL 3 refuses, and makes PFX files older Windows can import. Nothing is uploaded.
Save as PEM files
Save as a new PFX
How to convert PFX to PEM
- Drop the
.pfxor.p12file and enter its password. - Check what is inside: your certificate, the chain certificates and the private key, with a check that the key belongs to the certificate.
- Save the parts you need:
certificate.pem,chain.pem,fullchain.pem(certificate plus chain, what nginx and most web servers want) andprivate-key.pem.
How to create a PFX from PEM files
- Switch to create a PFX and drop the certificate, the private key and any chain files your certificate authority sent. The tool works out which is which, checks that the key matches and puts the chain in the right order.
- Choose a password and the compatibility, then save the
.pfx. It imports into Windows, IIS, Azure, macOS Keychain and Java keystores.
Modern or compatible?
Modern files protect the key with AES-256 and a SHA-256 integrity check, like OpenSSL 3 does by default. Compatible files use 3DES and SHA-1, which Windows Server 2016 and earlier, old Java versions and some appliances need, because they cannot read AES-protected PFX files. If an import fails with a password error even though the password is right, save it in the other format.
Old PFX files are often protected with RC2-40, which OpenSSL 3 no longer reads without the -legacy option and reports as "unsupported". Open such a file here and save it again as a modern PFX.
Frequently asked questions
Is my private key uploaded?
No. Files are read and converted in your browser tab. Nothing is sent to a server, and the page works offline once loaded.
What is the difference between .pfx and .p12?
Nothing: both are PKCS#12 files that hold a certificate, its chain and the private key in one password-protected file. Windows tends to use .pfx, other systems .p12.
Which key types are supported?
RSA and ECDSA (P-256, P-384, P-521) keys, in PKCS#8, traditional RSA and EC formats, and password-protected PKCS#8 keys. The match check also covers Ed25519.
Why does nginx or Apache want fullchain.pem?
Browsers need the intermediate certificates to trust yours. fullchain.pem holds your certificate followed by the chain in the right order, so the server can send them all.