Convert PFX (P12) to PEM certificate and key
Open a PFX or P12 file with its password to get the certificate, private key and chain as separate PEM files, ready for Nginx, Apache, HAProxy or Kubernetes. Legacy files encrypted with RC2 or 3DES work too. Decryption happens in your browser.
What you can do
- Certificate, private key and chain as separate PEM files
- Full-chain PEM for Nginx and HAProxy
- Private key as PKCS#8, PKCS#1 or encrypted PKCS#8
- Opens legacy RC2-40 and 3DES files that OpenSSL 3 rejects by default
- Password stays in the browser
Frequently asked questions
What is the OpenSSL command for PFX to PEM?
openssl pkcs12 -in site.pfx -out site.pem -nodes writes the certificates and an unencrypted key into one file. With OpenSSL 3, older files also need -legacy.
Why does OpenSSL 3 fail with “unsupported” or RC2-40-CBC errors?
Older PFX files are encrypted with RC2-40 or 3DES, which OpenSSL 3 disables by default. PKIScope can still open them in the browser.
Will the extracted private key be encrypted?
You choose: plain PKCS#8, PKCS#1 for RSA keys, or PKCS#8 encrypted with a new password.
Related tools
- PEM to PFX — Combine certificate, key and chain into a PFX/P12
- Converter — All conversions: PEM, DER, PFX, PKCS#1/PKCS#8, chains, key passwords
- Kubernetes secret — Decode and check a Kubernetes TLS Secret
- Viewer — Inspect and debug certificates, PFX files, keys, CSRs and CRLs