Browse Tools Top 100
PEM PFX
File conversion

Convert PEM to PFX

Verified by Adam B.· reviewed by FE Editorial ·updated Sep 7, 2026
QUICK ANSWER
Is it possible to convert PEM to PFX?
Yes - PEM converts to PFX.

Run openssl pkcs12 -export -in cert.pem -inkey key.pem -out certificate.pfx and set an export password. You need both the certificate file and the matching private key file before you start.

Also to PFX: P12 · JKS · P7B

On this page

Tested on macOS, Windows & Linux
Last verified Oct 2026

More free converters

HEIC, PNG, WEBP, MP3 and more - every tool here is free.

Open the toolbox

Why convert PEM to PFX?

Linux-based web servers (Apache, Nginx) use .pem files directly, but Windows servers, IIS, Azure App Service, and many certificate import wizards expect a single .pfx container. If you received your SSL certificate in .pem format and need to install it on a Windows system, converting to .pfx is the standard step.

How to convert PEM to PFX

OpenSSL FREE

Run openssl pkcs12 -export -in cert.pem -inkey key.pem -out certificate.pfx; add -certfile chain.pem if you have intermediate CA certificates. OpenSSL is FREE and runs on Windows, macOS, and Linux.

About these formats

.PEM PEM - Base64-encoded certificate / key container (X.509, PKCS)

A PEM file is a text container for cryptographic data - most often an SSL/TLS certificate, a private key, or both. Open it in any text editor to see what the BEGIN line says, then use…

Open .PEM details →
.PFX PKCS #12 Personal Information Exchange File

A PFX file is an encrypted, password-protected bundle that holds a digital certificate together with its private key (the PKCS #12 format). You do not open it like a document - you import…

Open .PFX details →

Quality & what to watch

  • You need both the certificate .pem and the matching private key file before running the command - without the private key the .pfx cannot be used for TLS.
  • Never send your .pem private key to an online converter - private keys are server passwords; perform this conversion locally only.
  • IIS and most Windows import wizards require a non-empty export password; choose a strong one and record it, as you will need it during import.

Frequently asked questions

Do I need both the certificate and the private key to create a PFX?
Yes - a .pfx bundles the certificate, private key, and optionally the CA chain; you cannot create a valid one without the private key.
Where do I get OpenSSL on Windows?
Download it from slproweb.com or use the version bundled with Git for Windows; it is pre-installed on macOS (as LibreSSL) and most Linux distributions.
What password should I use for the PFX export?
Choose a strong password; IIS and many import wizards require one - pressing Enter for no password may cause the import to fail.
Can I include intermediate CA certificates in the PFX?
Yes - add -certfile chain.pem to the OpenSSL command to bundle the chain alongside your certificate and key.