DE

↑ ↓ select, Enter open, Esc close

Convert a certificate and key from PEM to PFX

cautionSSL and certificatesalle

Caution: This command changes the system. Understand what it does before you run it.

Adjust the values, the command updates live
user@server
openssl pkcs12 -export -out example.com.pfx -inkey example.com.key -in example.com.crt -certfile chain.pem

Creates a PKCS#12 file containing the certificate, key and chain, and asks interactively for an export password. Windows, IIS, Exchange and some Java applications expect this format. An existing target file is overwritten.

Note: OpenSSL 3 encrypts with AES by default. Older Windows versions cannot import such files, in that case add -legacy.

Also searched as

  • convert pem to pfx openssl
  • export certificate for windows iis
  • create p12 file from crt and key
  • combine crt and key into pfx

Related one-liners

All in SSL and certificates

Convert a PFX file to PEM with certificate and key

$openssl pkcs12 -in example.com.pfx -out example.com.pem -nodes
cautionSSL and certificates

Check the contents of a CSR before submitting it

$openssl req -in example.com.csr -noout -text -verify
harmlessSSL and certificates

Check the SSL certificate expiration date of a website

$openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates
harmlessSSL and certificates

Check whether a certificate expires within the next days

#openssl x509 -in /etc/letsencrypt/live/example.com/cert.pem -noout -checkend $(( 30 * 86400 )) && echo "noch gültig" || echo "läuft bald ab"
harmlessSSL and certificates

Check whether a private key matches a certificate

#openssl x509 -noout -modulus -in /etc/ssl/certs/example.com.crt | openssl md5 && openssl rsa -noout -modulus -in /etc/ssl/private/example.com.key | openssl md5
harmlessSSL and certificates

Check whether a server supports TLS 1.3

$openssl s_client -connect example.com:443 -servername example.com -tls1_3 </dev/null 2>/dev/null | grep -E "^New,|Protocol *:"
harmlessSSL and certificates

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.