PFX to PEM Certificate Converter Online

PFX Data (Base64)

Password (optional)

About PFX to PEM Conversion

PFX (also known as PKCS#12) is a binary archive format that stores a server certificate, intermediate certificates, and the private key in a single encrypted file. PEM format uses Base64 ASCII encoding with header and footer lines, making it the standard format for Apache, Nginx, and most Linux-based web servers. Our converter extracts certificate metadata — including subject, issuer, validity dates, SAN entries, and fingerprint — alongside the PEM-encoded output.

How to Use

Export your PFX file and encode it as Base64 text.
Paste the Base64-encoded PFX data into the input field.
Enter the PFX password if the file is password-protected.
Click Convert to PEM and download or copy the result with full certificate metadata.

Use Cases

Server Migration: Convert PFX certificates exported from Windows/IIS to PEM format for use on Linux servers running Apache or Nginx.
Certificate Format Conversion: Transform PKCS#12 archives into individual PEM files for use with OpenSSL, HAProxy, and other tools.
Certificate Inspection: Extract and review certificate metadata including subject, issuer, validity dates, and SAN entries before deployment.
Backup Recovery: Recover readable certificate and key data from encrypted PFX backup files when the original PEM files are lost.

How to Convert PFX to PEM with OpenSSL

A PFX file (also called PKCS#12) is a container that holds your certificate, your private key and usually the intermediate chain — all in one encrypted file. PEM is the plain-text format that Nginx, Apache and IIS expect. These are the exact commands, including the passwordless case.

1. The standard conversion (certificate and key together)

openssl pkcs12 -in input.pfx -out output.pem -nodes

OpenSSL prompts for the PFX password, then writes a single output.pem containing the private key first and the certificate chain after it. -nodes is what stops OpenSSL encrypting the key again — without it you get a second password prompt when you try to use the key.

2. When the PFX has no password

openssl pkcs12 -in input.pfx -out output.pem -nodes -passin pass:

The empty string after pass: tells OpenSSL the password is blank. If the PFX is protected by something other than a password, use -passin file:password.txt to keep the password out of your shell history.

3. Split it into separate certificate and key files

# certificate (and the chain that came with it)
openssl pkcs12 -in input.pfx -out certificate.pem -nokeys

# unencrypted private key
openssl pkcs12 -in input.pfx -out private.key -nocerts -nodes

# keep only the leaf certificate
openssl pkcs12 -in input.pfx -nokeys -clcerts -out server.crt

This is what you usually want for a web server: Nginx needs the key in ssl_certificate_key and the chain in ssl_certificate, as two separate files.

4. If the chain is missing, add it

openssl pkcs12 -export -in leaf.crt -inkey private.key \
  -certfile intermediate.crt -out bundle.pfx

A PFX created from a certificate on its own often contains no intermediate, which produces unable to get local issuer certificate errors in every browser. Rebuild it with -certfile.

5. Check the result before you deploy it

openssl x509 -in certificate.pem -noout -subject -dates -issuer
openssl rsa -in private.key -noout -check        # RSA keys
openssl pkey -in private.key -noout -check       # any key type

Confirm the key and certificate actually match before uploading them, otherwise the server fails to start with key values mismatch:

# compare these two hashes
openssl x509 -noout -modulus -in certificate.pem | openssl md5
openssl rsa  -noout -modulus -in private.key   | openssl md5

Windows PowerShell equivalents:

certutil -p PASSWORD -importpfx input.pfx
$key = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new("output.pfx", "PASSWORD", "Exportable")
[System.IO.File]::WriteAllText("private.key", $key.PrivateKey.ExportRSAPrivateKey())

Frequently Asked Questions

PFX (PKCS#12) is a binary format that bundles the certificate chain and private key into a single encrypted file, commonly used on Windows. PEM is a text-based format with Base64-encoded content between header/footer lines, widely used on Linux and Unix servers.

Only if the PFX file was created with a password. Many PFX exports are password-protected to secure the private key. If your PFX file has no password, you can leave the password field empty.

All data is transmitted over HTTPS and processed server-side. We do not store or log your certificate data or private keys. For maximum security, consider running the conversion locally using OpenSSL.

A PFX holds both, so you usually want one out of it. Add -nocerts -nodes for the key alone, or -nokeys for the certificate alone. Nginx and IIS both want them as two separate files: the key in one file, the chain in another. Add -clcerts if you only want the leaf and not the intermediates.

Because it was exported from a certificate file that had no intermediates in the first place, which happens whenever someone uploads only the certificate the CA emailed them. The result is a PFX containing one certificate, and every client then fails with unable to get local issuer certificate. Rebuild it with -certfile intermediate.crt, or check the download in this tool: the chain section shows whether intermediates came with it.

It means OpenSSL could not decrypt the PFX with the password you supplied, not that the file is broken. Three usual causes: a different password from the one the file was created with, a file that has no password at all, or a PFX protected by a hardware token. Try the empty password with -passin pass:. If the file was made in Windows certificate store, a wrong export password is the most likely explanation.

Use PowerShell. Import it with Import-PfxCertificate, or load it with X509Certificate2::new("output.pfx", "PASSWORD", "Exportable") and write the key with ExportRSAPrivateKey(). This page converts in the browser without sending the file anywhere, which is the simplest route if you are on Windows and just need the PEM.

Compare the modulus hash of each file. Run openssl x509 -noout -modulus -in certificate.pem | openssl md5 and then openssl rsa -noout -modulus -in private.key | openssl md5. Identical output means the pair belongs together. If they differ, the server will refuse to start with key values mismatch, which is a much less obvious failure than an expired certificate.

Technical Details

Input: PKCS#12 (.pfx, .p12) files with optional password protection
Output: PEM files for certificate, private key, and chain
Security: Password-protected PFX handling with secure key extraction
Compatibility: Output compatible with Nginx, Apache, HAProxy

PFX to PEM Converter

PEM Output