How to Convert PEM Certificates to PFX Format Using OpenSSL in Linux

Why Convert PEM to PFX?

When you purchase an SSL/TLS certificate from a public Certificate Authority (CA) or generate one using Let’s Encrypt on a Linux server, you are typically provided with Base64-encoded ASCII files (.pem, .crt, and .key). While Linux web servers like Nginx and Apache consume these individual files perfectly, Microsoft environments (like IIS, Exchange, and Remote Desktop) absolutely require the certificate and the private key to be bundled together into a single, password-protected Personal Information Exchange file (.pfx or .p12). You must convert the files before importing them into a Windows Server.

Step 1: Gather Your Certificate Files

Ensure you have all the necessary components on your Linux server. You will generally need three files in the same directory:

1. The Private Key: Usually named private.key or privkey.pem.
2. The Public Certificate: Your actual domain certificate (e.g., domain.crt or cert.pem).
3. The CA Bundle (Chain): The intermediate certificates provided by your issuer (e.g., ca-bundle.crt or chain.pem).

Step 2: Run the OpenSSL Conversion Command

The OpenSSL toolkit is installed by default on almost all Linux distributions. Use the pkcs12 utility to bundle the files together. Open your terminal and run the following command (adjusting the filenames to match your specific files):

openssl pkcs12 -export -out certificate.pfx -inkey private.key -in domain.crt -certfile ca-bundle.crt

• -export: Tells OpenSSL to create a PKCS#12 file.
• -out: Specifies the name of the final PFX file you are creating.
• -inkey: Points to your private key file.
• -in: Points to your primary domain certificate.
• -certfile: Points to the intermediate chain file.

Step 3: Secure the PFX with a Password

Because the new PFX file contains your highly sensitive private key, OpenSSL will immediately prompt you to secure the bundle with an export password:

Enter Export Password:
Verifying - Enter Export Password:

Type a strong password and press Enter. You must remember this password! Windows IIS will strictly require you to type this exact password when you attempt to import the PFX file into the server’s certificate store.

Step 4: Verify the New PFX File

You should now see the certificate.pfx file in your directory. To verify that the bundle correctly contains both the certificate and the private key without corruption, you can parse it using OpenSSL:

openssl pkcs12 -info -in certificate.pfx

You will be prompted to enter the export password you just created. The command will then output the cryptographic details of the certificate and the encrypted private key block.

Step 5: Transfer to Windows

The conversion is complete. You can now securely transfer the certificate.pfx file to your Windows Server (using SCP, SFTP, or a secure network share). Once on the Windows Server, you can simply double-click the file to launch the Certificate Import Wizard, or import it directly through the IIS Manager bindings menu.