Howto convert a PFX to a seperate .key/.crt file

4 Aug

In this article I’m going to show you the commands you need to convert your .PFX Certificate file to a seperate certificate and keyfile. This article can come in handy when you need to import your certificates on devices like Cisco routers/loadbalancers etc. where you probably need to import the certificates and keyfiles in plain text (unencrypted). My tool of choice (but there might be others) is OpenSSL for Windows, which can be downloaded here

So after you installed OpenSSL you can start it from it’s Bin folder. I’d like to put OpenSSL\Bin in my path so I can start it from any folder. Fire up a command prompt and cd to the folder that contains your .pfx file. First type the first command to extract the private key:

openssl pkcs12 -in [yourfile.pfx] -nocerts -out [keyfile-encrypted.key]

What this command does is extract the private key from the .pfx file. Once entered you need to type in the importpassword of the .pfx file.  This is the password that you used to protect your keypair when you created your .pfx file.  If you cannot remember it anymore you can just throw your .pfx file away, cause you won’t be able to import it again, anywhere!.  Once you entered the import password OpenSSL requests you to type in another password, twice!. This new password will protect your .key file.

Now let’s extract the certificate:

openssl pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out [certificate.crt]

Just press enter and your certificate appears.

Now as I mentioned in the intro of this article you sometimes need to have an unencrypted .key file to import on some devices.  I probably don’t need to mention that you should be carefully. If you store your unencrypted keypair somewhere on an unsafe location anyone can have a go with it and impersonate for instance a website or a person of your company.  So always be extra careful when it comes to private keys! Just throw the unencrypted keyfile away when you’re done with it, saving just the encrypted one.

The command:

openssl rsa -in [keyfile-encrypted.key] -out [keyfile-decrypted.key]

Again you need to enter an import password. This time you need to enter the new password that you created in step 1.  After that you’re done. You decrypted your private key. In the folder you ran OpenSSL from you’ll find the certifcate (.crt) and the two private keys (encrypted and unencrypted).

Update 07-07-2014:

In some cases you might be forced to convert your private key to PEM format. You can do so with the following command:

openssl rsa -in [keyfile-encrypted.key] -outform PEM -out [keyfile-encrypted-pem.key]

Good Luck!


  • Patrick, is saying:

    Thanks for your blog. Really useful!

    Reply this message
  • Harald Mühlhoff, is saying:

    Thank you very much! I’ve used it to generate a key file for my Synology NAS.

    Reply this message
  • Ernst, is saying:

    Thanks Mark for this post. This has helped me dealing with this apache error. In particular, the unencrypted key is needed in this case.

    [error] SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
    [error] Init: SSLPassPhraseDialog builtin is not supported on Win32 (key file C:/Program Files (x86)/Apache Software Foundation/Apache2.2/conf/ssl/keyfile.key)

    Reply this message
  • Ulkesh Parikh, is saying:

    Excellent article this did the trick for me. Thank you.

    Reply this message
  • Anthony, is saying:

    Simple and easy to follow. I ran this all in a CentOS Linux using openssl and it works just fine as well. Thank you.

    Reply this message
  • Guillermo, is saying:

    Mark, thx for your blog, is realy usefull, always that I have to install a certificate and i have to convert in a cert and key I look like a crazy for the commands and always this URL is the solution.

    Reply this message
  • zSprawl, is saying:

    Worked like a charm. Thank you!!

    Reply this message
  • Anton, is saying:

    Thank’s for recipes!

    Reply this message
  • byron, is saying:

    This is exactly what I am looking for, thanks for sharing!

    Reply this message
  • Braam, is saying:

    Thank you!

    Reply this message
  • Dan Barnes, is saying:

    Easy to do but forget. Always refer to this, its really useful and is in my favourites!

    Reply this message
  • JH, is saying:

    Thank you!! Saved us a lot of time!

    Reply this message
  • Deepak, is saying:

    Thanks – helped me

    Reply this message
  • Renan, is saying:


    Reply this message
  • Red Boll, is saying:

    Thank you for this info, this saves me some grey hair! 🙂
    I needed the unencrypted key file for my Synology NAS’s.

    Will be back next year when I need to renew the certificates again. 🙂

    Reply this message
  • Sam, is saying:

    Thank you very much for this!

    It’s an exact summary of the commands I needed to work with SSL.

    Reply this message
  • KERR, is saying:

    Really useful article, thanks. The only thing I encountered was a prompt to “Enter PEM pass phrase” – I had to google it and found out it’s actually asking the user to set a password.

    Reply this message
  • Ritter, is saying:

    Awesome! Thank you, saved my day.

    Reply this message

Leave a Reply