PFX / P12 to PEM Converter

A .pfx or .p12 file (PKCS#12) bundles a certificate, its chain and the private key, protected by a password — the format Windows, IIS, Azure and many Java tools export. Web servers such as nginx and Apache, and most Linux tools, want separate PEM files instead. This converter opens the file with your password, checks its integrity, decrypts it, and gives you the certificate, the chain and the private key as PEM — without uploading anything.

How to use this tool

1. Choose the .pfx or .p12 file (or paste it as Base64).
2. Enter its password and press Calculate.
3. Download certificate.pem, chain.pem and private-key.pem, or bundle.pem with all three.
4. Store the private key safely: it is no longer password-protected.

Formula

PFX → verify MAC (HMAC with a key from the password) → decrypt each bag (PBES2/AES or PKCS#12 3DES/RC2) → PEM = Base64 of the DER between BEGIN/END lines

Modern files (OpenSSL 3 default, Windows Server 2019+) use PBES2: PBKDF2 with HMAC-SHA-256 and AES-256-CBC. Older files use PKCS#12’s own key derivation with SHA-1, 3-key Triple DES for the key and 40-bit RC2 for the certificates; both kinds are read here. The certificate whose localKeyId matches the key is the leaf; the others form the chain, ordered from its issuer upwards.

Example

A file made with openssl pkcs12 -export (AES-256, MAC HMAC-SHA-256, 2048 iterations) holding a P-256 key, the certificate for www.example.test and its root Test Root CA gives 2 certificates and 1 private key: certificate.pem is the www.example.test certificate, chain.pem the root, and private-key.pem a "BEGIN PRIVATE KEY" block identical to the original key.