Skip to content
MtrXTools

PFX converter

Extract the certificate, chain and private key from a .pfx or .p12 file as PEM for Nginx, Apache or HAProxy, or build a PFX from PEM files for IIS, Azure and Windows, with modern or compatible encryption. Runs in your browser; nothing is uploaded.

Open a PFX

  • Opens .pfx and .p12 files from Windows, IIS, Azure, macOS Keychain, Java keytool and OpenSSL, including older ones encrypted with 3DES or RC2.
  • Gives you the certificate, the intermediate chain, a full-chain file for Nginx (ssl_certificate), the private key (PKCS#8 or RSA/EC), and a single key-plus-chain file for HAProxy.
  • Checks that the key matches the certificate, puts the chain in order, and shows how the file is protected, flagging legacy encryption that is easier to crack.

Create a PFX

  • Paste the certificate, any intermediates in any order, and the private key (encrypted keys work too). The converter finds the certificate that belongs to the key and orders the chain.
  • Modern encryption (AES-256 with SHA-256, what OpenSSL 3 creates) suits current Windows, macOS, Java and Azure. Compatible encryption (3DES with SHA-1) is for older systems such as Windows Server 2016, older macOS Keychain and older Java 8 updates, which reject AES-encrypted files.

The file, its password and the key never leave your browser.

Java and JKS

Since Java 9, PKCS#12 is Java's default keystore format, so keytool, Tomcat, Spring Boot and Jetty use a .pfx or .p12 directly; converting to JKS is rarely needed and its encryption is weak. The page shows the keytool commands to import a PFX into an existing JKS keystore or turn a JKS into a PFX. Use a plain ASCII password, because Java can't open PKCS#12 files with non-ASCII passwords.

Questions

Why does Windows say the password is wrong when it is right?
Older Windows versions can't read PFX files encrypted with AES, which OpenSSL 3 uses by default, and report it as a wrong password. Re-create the file with compatible (3DES) encryption.
What is the difference between .pfx and .p12?
Nothing: both are PKCS#12 files. Windows tends to use .pfx and other systems .p12.
Can I open a PFX without the password?
No. The password protects both the file's integrity check and the encrypted private key. Some files have an empty password; leave the field blank to try that.
Do I need the intermediate certificates?
Yes for a server: without the chain, browsers may show "unable to verify" errors on devices that don't already have the intermediate. Include the intermediates when creating the PFX.

Related tools