Convert PEM certificate and key to PFX (P12)
Drop your certificate, private key and any intermediate certificates. PKIScope checks that the key matches, puts the chain in the right order and builds a password-protected PFX/P12 file for Windows, IIS, Azure or Java. Your key never leaves the browser.
What you can do
- Certificate, private key and chain in one PFX/P12 file
- Checks that the key matches the certificate before building
- Orders the chain from leaf to root automatically
- Modern AES-256 or Windows-compatible 3DES encryption
- RSA, ECDSA and Ed25519 keys, encrypted or plain
Frequently asked questions
What is the OpenSSL command for PEM to PFX?
openssl pkcs12 -export -out site.pfx -inkey site.key -in site.crt -certfile chain.pem. PKIScope does the same without OpenSSL, and checks that the key matches the certificate before it builds the file.
Which PFX encryption should I choose?
Modern mode (AES-256 with PBKDF2-SHA256) works with OpenSSL 3, recent Windows and Java. Choose compatible mode (3DES) for older Windows Server, macOS Keychain or legacy Java, which can't read AES-encrypted PFX files.
Why does OpenSSL say “key values mismatch”?
The private key doesn't belong to the certificate. PKIScope pairs keys and certificates by their public key and tells you which key fits which certificate.
Related tools
- PFX to PEM — Extract certificate, key and chain from a PFX/P12
- Converter — All conversions: PEM, DER, PFX, PKCS#1/PKCS#8, chains, key passwords
- Viewer — Inspect and debug certificates, PFX files, keys, CSRs and CRLs
- Java keystore — Open JKS/JCEKS keystores and convert them to PFX or PEM