What is the PFX file format?
.pfx files are associated with the PKCS #12 cryptography standard, originally developed by RSA Laboratories and now governed by RFC 7292.
Files with the .pfx extension store encrypted and digitally signed cryptographic objects in a binary DER-encoded container. Each .pfx file is divided into so-called SafeBags, which can also be independently encrypted and signed. The PKCS #12 standard further divides SafeBags into types suitable for storing private keys, X.509 certificates, certificate chains, and other security data.
.pfx is most commonly used to bundle a private key together with its matching certificate chain in a single password-protected file. Typical uses include exporting TLS/SSL certificates between servers, distributing code-signing identities, and transferring S/MIME credentials between devices.
.pfx and .p12 are functionally identical - Windows tools use .pfx while macOS and Linux prefer .p12. Both can be converted to .pem text format with the openssl pkcs12 command. Unlike standalone .cer certificates, a .pfx file carries the private key alongside the certificate, making it the preferred format when the key must travel with the cert.
Security & safety
RISK: HIGHA PFX contains a PRIVATE KEY, so it is one of the most sensitive file types a user handles: anyone with the file and its password can impersonate the certificate's owner - sign code or documents as them, or stand up a server with their TLS identity. Never email a PFX unprotected, never commit it to source control, use a strong export password, and store it securely (ideally delete the file after importing). Treat an unexpected .pfx attachment as suspicious. Only generate/handle PFX files with trusted tools (OS wizards, OpenSSL) - not random "certificate viewer" websites, which could exfiltrate your key and password.
Format details
in a nutshellFULL NAMEPKCS #12 Personal Information Exchange File
DEVELOPERRSA Laboratories (PKCS #12 standard); now IETF RFC 7292since PKCS #12 v1.0 published 1999 by RSA; Microsoft .pfx predates and feeds into it
CATEGORYSystem Files
MIME TYPEapplication/x-pkcs12
TYPEEncrypted, password-protected key+certificate bundle (binary, DER/PKCS#12)
STANDARDOpen · royalty-free
MAGIC BYTES · FILE SIGNATURE
OFFSET
0001
HEX
3082
ASCII
0·
Starts with the DER tag 30 82 xx xx (an ASN.1 SEQUENCE with a 2-byte length) - the same generic prefix as many DER-encoded crypto objects, so it is not unique to PFX. The content is a PKCS#12 structure; identify by extension/context, not by the first bytes alone.
Programs that open PFX files
Windows4 apps
OpenSSL
Open-source Extract or convert: 'openssl pkcs12 -in file.pfx -out out.pem -nodes' (prompts for the password).
Windows Certificate Import Wizard (built-in)
Built-in Double-click the .pfx → the Certificate Import Wizard opens; enter the password and choose the store (Personal/Current User or Local Machine).
certutil / PowerShell (built-in)
Built-in Inspect/import from a shell: 'certutil -dump file.pfx' or PowerShell 'Get-PfxData -FilePath file.pfx' / 'Import-PfxCertificate'.
Adobe Acrobat (as a digital ID, not a viewer)
Freemium Edit/Preferences → Signatures → Identities & Trusted Certificates → add the .pfx as a Digital ID for signing PDFs. It does not display the file as a document. 
macOS2 apps
OpenSSL
Open-source Use 'openssl pkcs12 -in file.pfx ...' in Terminal to inspect or extract the key/certificate for server use.
Keychain Access (built-in)
Built-in Double-click the .pfx → it imports into Keychain Access (enter the file password); the identity is then available to apps. 
Linux2 apps
OpenSSL
Open-source Split into PEM parts for Apache/Nginx: key 'openssl pkcs12 -in file.pfx -nocerts -out key.pem'; cert '... -clcerts -nokeys -out cert.pem'.
GNOME Keyring / Seahorse
Open-source Import the .pfx/.p12 into the 'Passwords and Keys' (Seahorse) app to store the certificate and key. Technical details
deep spec| Container encoding | Binary DER (Distinguished Encoding Rules) over ASN.1; the file is not human-readable without a dedicated parser |
| MIME type | application/x-pkcs12 |
| Magic bytes | 30 82 at offset 0 (ASN.1 DER SEQUENCE with 2-byte length); shared with other DER-encoded formats - identify by extension or MIME type, not bytes alone |
| Internal structure | Nested layers: PFX → AuthenticatedSafe → SafeContents → SafeBags; each SafeBag holds one typed cryptographic object |
| SafeBag types | KeyBag, PKCS8ShroudedKeyBag, CertBag, CRLBag, SecretBag, SafeContents - the six official SafeBag types defined in RFC 7292 |
| Password protection | The overall archive and individual SafeBags can each be encrypted independently with a user-chosen passphrase via password-based encryption |
| Encryption algorithms | AES-256-CBC and 3DES-CBC for modern stacks; RC2 and RC4 appear in legacy files (deprecated - avoid when generating new archives) |
| MAC integrity | An HMAC (SHA-1 in legacy; SHA-256 or SHA-384 in modern implementations) covers the AuthenticatedSafe structure to detect tampering |
| Key derivation | PBKDF1 (RFC 7292 Appendix B) or PBKDF2 with configurable iteration count hardens password-based encryption against brute-force attacks |
| Windows vs. IETF name | .pfx is the original Microsoft-coined suffix; .p12 is the IETF-standard name; the two are byte-for-byte identical and fully interchangeable |
| Multi-object storage | A single .pfx can contain multiple certificates and keys - for example, a full chain of leaf, intermediate, and root CA certificates plus the private key |
| Common CLI conversion | openssl pkcs12 -in file.pfx -out file.pem -nodes extracts to PEM text; openssl pkcs12 -export -out file.pfx bundles PEM inputs into a new archive |
| Platform support | Native on Windows (Certificate Import Wizard, certutil, PowerShell), macOS (Keychain Access), iOS, Android, Java (keytool), and most TLS libraries |
| Typical use cases | Deploying TLS/SSL server certificates, code-signing identities, S/MIME email keys, VPN client credentials, and smart-card provisioning |
| Released | PKCS #12 v1.0 published 1999 by RSA; Microsoft .pfx predates and feeds into it |
| Open standard | Yes · royalty-free |
| Specification | www.rfc-editor.org |
PFX conversions
Possible
.PFX .CRTGUIDE
Yes - extract the public certificate from a PFX file with one OpenSSL command or the Windows Certificate…
How to convert
.PFX .P12GUIDE
Yes - in most cases, rename the file from .pfx to .p12; both are the same PKCS#12 binary format.
How to convert
.PFX .CERGUIDE
Yes - extract the public certificate from your PFX file with one OpenSSL command or through the Windows…
How to convert
.PFX .PEMGUIDE
Yes - OpenSSL converts a PFX to PEM in one command on Windows, macOS, and Linux.
How to convert
.PFX .KEYGUIDE
Yes -- extract the private key from a PFX file using OpenSSL: openssl pkcs12 -in file.pfx -nocerts -nodes…
How to convert
.PFX .JKSGUIDE
Yes -- the standard way is Java's built-in keytool utility: one command on Windows, macOS, or Linux.
How to convert
Not possible
Community Q&A
asked by users
M
Frequently asked questions
What is a PFX file?
An encrypted, password-protected bundle (the PKCS #12 / .p12 format) that holds a digital certificate plus its private key, used for TLS certificates, code signing, client authentication and document signing.
How do I open a PFX file on Windows?
Double-click it to launch the Certificate Import Wizard, enter the password it was created with, and choose a certificate store. To inspect it instead, use 'certutil -dump file.pfx' or OpenSSL - you don't 'read' a PFX, you import it.
What's the difference between .pfx and .p12?
None in practice - both are the PKCS #12 format. .pfx is Microsoft's name, .p12 the more general one. You can usually just rename one to the other.
How is a PFX different from a CER/CRT certificate?
A .cer/.crt holds only the public certificate and is safe to share. A .pfx also contains the private key, which is secret - it can re-create the full identity, so it must be protected.
How do I extract the certificate and key from a PFX for Apache/Nginx?
Use OpenSSL: 'openssl pkcs12 -in file.pfx -clcerts -nokeys -out cert.pem' for the certificate and '... -nocerts -nodes -out key.pem' for the private key.
I lost the PFX password - can I still open it?
No. The private key is encrypted with that password and there's no legitimate recovery. You'll need to re-export the certificate from where it was created, or have a new one issued.
Can Adobe Acrobat open a PFX file?
Acrobat can import a PFX as a 'digital ID' to sign PDFs, but it doesn't open it as a viewable document. To install the certificate itself, use the Windows certificate store or macOS Keychain.
References
1IETF RFC 7292 - PKCS #12: Personal Information Exchange Syntax v1.1www.rfc-editor.org
2Microsoft Learn - Export/import certificates with private keys (PFX)learn.microsoft.com
