DE

↑ ↓ select, Enter open, Esc close

Convert a PFX file to PEM with certificate and key

cautionSSL and certificatesalle

Caution: This command changes the system. Understand what it does before you run it.

Adjust the values, the command updates live
user@server
openssl pkcs12 -in example.com.pfx -out example.com.pem -nodes

Asks for the import password and writes all included certificates and the private key into a PEM file, as expected by Apache, nginx or Plesk. With -nodes the key is stored unencrypted, so protect the file right away with chmod 600. Certificate and key can then be split into separate files with a text editor.

Note: With older PFX files, OpenSSL 3 may report unsupported algorithm, in that case add -legacy.

Also searched as

  • convert pfx to pem openssl
  • extract crt and key from p12
  • use windows certificate on linux
  • unpack pfx file

Related one-liners

All in SSL and certificates

Convert a certificate and key from PEM to PFX

$openssl pkcs12 -export -out example.com.pfx -inkey example.com.key -in example.com.crt -certfile chain.pem
cautionSSL and certificates

Show the expiry date and subject of a certificate file

#openssl x509 -in /etc/letsencrypt/live/example.com/cert.pem -noout -subject -issuer -enddate
harmlessSSL and certificates

Check the contents of a CSR before submitting it

$openssl req -in example.com.csr -noout -text -verify
harmlessSSL and certificates

Check the SSL certificate expiration date of a website

$openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates
harmlessSSL and certificates

Check whether a certificate expires within the next days

#openssl x509 -in /etc/letsencrypt/live/example.com/cert.pem -noout -checkend $(( 30 * 86400 )) && echo "noch gültig" || echo "läuft bald ab"
harmlessSSL and certificates

Check whether a private key matches a certificate

#openssl x509 -noout -modulus -in /etc/ssl/certs/example.com.crt | openssl md5 && openssl rsa -noout -modulus -in /etc/ssl/private/example.com.key | openssl md5
harmlessSSL and certificates

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.