Converting a PEM (Privacy Enhanced Mail) certificate to a PKCS #12 (Public Key Cryptography Standards) or PFX (Personal Information Exchange) certificate can be useful if you wish to install the certificate on a server or device that requires PKCS #12 or PFX. Here are the steps you need to follow to carry out this conversion:
Prerequisites for the conversion
Before you begin, ensure you have the following files:
- Your PEM certificate (usually with the extension .pem or .crt)
- Your private key (usually with the extension .key)
- (Optional) The intermediate certificates or CA bundle (usually with the extension .crt or .pem)
You will also need OpenSSL, a powerful tool for managing certificates and keys. OpenSSL is pre-installed on most Linux distributions and can also be installed on Windows and macOS.
Conversion process from PEM to PKCS #12 / PFX
Run the following command in the console or terminal to convert your PEM certificate and private key into a PKCS #12 / PFX certificate:
openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt
An overview of the components of this command:
- certificate.pfx - the name of the PKCS #12 / PFX file you wish to create.
- privateKey.key - the name of your private key file.
- certificate.crt - the name of your PEM certificate file.
- CACert.crt - for the name of your CA bundle file (optional, if available).
When you run this command, you will be prompted to enter a password. This password is required to install the PKCS #12 / PFX certificate.
Note: If you do not have a CA bundle, you can omit the `-certfile CACert.crt` part of the command.
Once you have run this command, you should have a .pfx file that you can install on your server or device. Make sure you keep the password you created during the conversion process in a safe place.
Important information:
There are providers and websites that offer this conversion service. We advise against using them, as there is no guarantee as to what happens to the files, and the private key (.key file) should never fall into the hands of third parties!