PEM to PFX Builder
The file Windows asks for, assembled from the PEM files a Linux-shaped world hands you — without installing OpenSSL.
What this tool does
Takes the three things a Linux-shaped world hands you — a certificate, the intermediates above it, and the private key — and packs them into the single password-protected .pfx file that IIS, the Windows certificate store, Azure App Service, Exchange and Tomcat all ask for. It is the job openssl pkcs12 -export does, without needing OpenSSL installed on the machine you are sitting at.
The packing runs in this browser tab using the Web Crypto API. Your private key is read by the page and written into a file the page hands back to you; it is never sent to this server. Disconnect the network before you paste it if you want to prove that.
How to use it
- Certificate — paste the leaf certificate. If you paste a full chain (leaf first, then intermediates), every certificate in it goes into the file, which is what Windows wants.
- Private key — the key that matches that certificate.
PRIVATE KEY(PKCS#8),RSA PRIVATE KEY(PKCS#1) andEC PRIVATE KEY(SEC1) blocks are all accepted. - Password — required. Windows will ask for it on import, and a passwordless
.pfxis rejected by most importers anyway. - Friendly name — optional label shown in the Windows certificate store. Handy when several certificates look alike.
The key is checked against the certificate before anything is built, so a mismatched pair is caught here rather than after the import appears to succeed.
What comes out
A PKCS#12 file with the certificates stored in the clear — they are public — and the private key encrypted with PBES2, AES-256-CBC and PBKDF2-SHA-256, with a SHA-256 MAC over the whole container. That is the profile OpenSSL 3 writes by default and Windows has read since 8.1 / Server 2012 R2.
The leaf and the key are tagged with a matching localKeyID. Without it Windows imports the file and then shows a certificate with no private key attached, which is the single most common way a working .pfx looks broken in IIS.
Common problems
- Windows Server 2012 or older refuses the file. Those releases only read the old 3DES/RC2 encryption, which the browser cannot perform. Build the file with OpenSSL there:
openssl pkcs12 -export -legacy -inkey key.pem -in cert.pem -out out.pfx. - "This key does not match the certificate". The pair genuinely does not belong together — usually a key from an earlier CSR. The key matcher says which of the two is the odd one out.
- "This key is password-encrypted". Decrypt it first:
openssl pkcs8 -in key.pem -out key8.pem. - IIS shows the certificate but the site still fails. The intermediates are missing. Paste the full chain, not just the leaf, and rebuild.