How to convert a PFX to a separate .key/.crt file


Refer to below mentioned OpenSSL commands if you need to convert your .PFX Certificate file to a separate certificate and key file.

To run these commands you need OpenSSL and for this you can use Apache2.2 distribution.

So after you installed OpenSSL you can start it from its Bin folder. I’d like to put D:\Apache2.2\bin in my path Fire up a command prompt and cd to the folder that contains your .pfx file. First type the first command to extract the private key:

openssl pkcs12 -in [yourfile.pfx] -nocerts -out [keyfile-encrypted.key]

What this command does is extract the private key from the .pfx file. Once entered you need to type in the importpassword of the .pfx file (in my case the password is changeit). This is the password that you used to protect your keypair when you created your .pfx file. Once you entered the import password OpenSSL requests you to type in another password, twice!. This new password will protect your .key file. Use changeit as a password.

Now let’s extract the certificate:

openssl pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out [certificate.crt]

Just press enter and your certificate appears.

Use below command to decrypt the key file with NO PASSWORD.

The command:

openssl rsa -in [keyfile-encrypted.key] -out [keyfile-decrypted.key]

Again you need to enter an import password. This time you need to enter the new password that you created in step 1. After that you’re done. You decrypted your private key. In the folder you ran OpenSSL from you’ll find the certifcate (.crt) and the two private keys (encrypted and unencrypted).

In some cases you might be forced to convert your private key to PEM format. You can do so with the following command:

openssl rsa -in [keyfile-encrypted.key] -outform PEM -out [keyfile-encrypted-pem.key]


<<Click here to see all posts>>

If you found any of the information on this page helpful in anyway then please consider sharing this content with your favorite social network or by leaving your thoughts in the comment section. Thanks!

Leave a Reply

Your email address will not be published. Required fields are marked *

Prove You Are Human Time limit is exhausted. Please reload CAPTCHA.