PFX (also known as PKCS#12 or P12) is a binary archive format that bundles a certificate, its private key, and optionally the intermediate certificates — all in a single password-protected file. It's the standard exchange format on Windows, but Linux servers and most DevOps tools expect PEM format.
A PFX file is a container that can hold:
All contents are encrypted with a password using PKCS#12 encryption.
You'll encounter PFX files when:
openssl pkcs12 -in certificate.pfx -out everything.pem -nodes
-nodes means "no DES" — the private key won't be encrypted in the outputopenssl pkcs12 -in certificate.pfx -clcerts -nokeys -out cert.pem
-clcerts selects only the client (end-entity) certificate-nokeys excludes the private keyopenssl pkcs12 -in certificate.pfx -nocerts -nodes -out key.pem
-nocerts excludes all certificates-nodes outputs the key unencryptedSecurity note: Set strict permissions on the key file immediately:
chmod 600 key.pem
openssl pkcs12 -in certificate.pfx -cacerts -nokeys -chain -out chain.pem
-cacerts selects only CA certificates (not the end-entity)For Nginx, you need a file with the end-entity cert followed by intermediates:
# Extract cert and chain separately
openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out cert.pem
openssl pkcs12 -in certificate.pfx -cacerts -nokeys -chain -out chain.pem
# Concatenate in the correct order
cat cert.pem chain.pem > fullchain.pem
# Extract the private key
openssl pkcs12 -in certificate.pfx -nocerts -nodes -out key.pem
chmod 600 key.pem
Then in your Nginx config:
ssl_certificate /etc/nginx/ssl/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/key.pem;
Sometimes you need to go the other direction — create a PFX from PEM files:
# Basic: cert + key
openssl pkcs12 -export -out certificate.pfx \
-inkey key.pem \
-in cert.pem
# With intermediate chain
openssl pkcs12 -export -out certificate.pfx \
-inkey key.pem \
-in cert.pem \
-certfile chain.pem
# With a friendly name (visible in Windows cert store)
openssl pkcs12 -export -out certificate.pfx \
-inkey key.pem \
-in cert.pem \
-certfile chain.pem \
-name "My Server Certificate"
You'll be prompted to set an export password.
Mac verify error: invalid password?
PFX passwords are case-sensitive. Some PFX files have an empty password (not no password). Try:
# Empty password (press Enter when prompted)
openssl pkcs12 -in cert.pfx -out cert.pem -nodes
# Or specify empty password explicitly
openssl pkcs12 -in cert.pfx -out cert.pem -nodes -passin pass:
OpenSSL 3.x changed the default PKCS#12 algorithms. Older PFX files might fail with:
Error outputting keys and certificates
Fix by enabling legacy support:
openssl pkcs12 -in old.pfx -out cert.pem -nodes -legacy
When creating PFX files for older Windows systems:
openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert.pem \
-certfile chain.pem -legacy
If the PFX only contains the end-entity cert and key (no intermediates), you'll need to download the intermediates separately from your CA.
# Check what's in the PFX
openssl pkcs12 -in cert.pfx -nokeys -out certs.pem -nodes
grep -c "BEGIN CERTIFICATE" certs.pem
# 1 = only server cert (missing chain)
# 2+ = chain included
After extraction, verify the key matches the certificate:
# Compare modulus hashes — they must be identical
openssl x509 -noout -modulus -in cert.pem | openssl md5
openssl rsa -noout -modulus -in key.pem | openssl md5
If you don't have OpenSSL installed or prefer a visual approach, the PFX Decoder tab in our SSL Certificate Decoder can:
This is especially useful when you need to quickly inspect a PFX file you received and determine what certificates it contains before deploying.
| Task | Command |
|---|---|
| Extract everything | openssl pkcs12 -in f.pfx -out all.pem -nodes |
| Extract cert only | openssl pkcs12 -in f.pfx -clcerts -nokeys -out cert.pem |
| Extract key only | openssl pkcs12 -in f.pfx -nocerts -nodes -out key.pem |
| Extract CA chain | openssl pkcs12 -in f.pfx -cacerts -nokeys -out chain.pem |
| Create PFX from PEM | openssl pkcs12 -export -out f.pfx -inkey key.pem -in cert.pem |
| Fix legacy PFX | Add -legacy flag |
| Verify key matches cert | Compare openssl x509 -modulus vs openssl rsa -modulus |
PFX-to-PEM conversion is straightforward once you know the right OpenSSL flags. The key commands are -clcerts, -cacerts, -nocerts, -nokeys, and -nodes. Always verify your extracted key matches the certificate, set strict file permissions on private keys, and remember to build the full chain file for your server configuration.
For a visual alternative, try the PFX Decoder — it runs entirely in your browser, so your PFX file and private key never leave your device.