Coding
Learn about securing SSH connections on RHEL 9 and CentOS 9 with Ansible roles. This guide covers key SSH security practices, Ansible playbook setup, and
Learn how to archive and extract PFX/PKCS#12 certificate files using OpenSSL and Windows tools. Includes CLI examples, tables, and best practices for secure handling.
Whether you’re managing a secure web server, configuring enterprise authentication, or migrating SSL certificates across systems, understanding how to work with PFX certificate files (also known as PKCS#12 archives) is essential.
A .pfx file is a single, encrypted archive that typically contains a private key, the matching public certificate, and optionally, one or more intermediate certificates forming a full trust chain. It’s widely used in both Windows and Linux environments, and often plays a key role in web hosting (IIS, Apache, Nginx), DevOps pipelines, VPN setups, and secure email configurations.
But many IT professionals and developers hit a roadblock when it comes to:
|
|
|
|
This guide demystifies the process by offering step-by-step CLI examples, troubleshooting tips, security best practices, and detailed use cases for both Windows and Linux systems.
A PFX (Personal Information Exchange) file is a binary archive defined by PKCS#12, designed to store SSL/TLS certificates, private keys, and optionally intermediate CA chains. The file extensions are typically .pfx or .p12. Internally, it uses “SafeBags” to organize this cryptographic data, and supports encryption and integrity protection.
| Use Case | Description |
|---|---|
| Backup | Archive PFX to store securely or move to cold storage. |
| Convert to Other Formats | Extract components for tools that need .crt, .pem, or .key formats. |
| Migrate Between Systems | Export PFX for use on Linux, NGINX, Apache, or other environments. |
| CI/CD Integration | Automate certificate deployment by extracting key components for pipelines. |
| Debugging SSL Issues | Separate and test certs individually when diagnosing SSL/TLS errors. |
Photo by admingeek from Infotechys
.pfx File🔹Using OpenSSL |
openssl pkcs12 -export \
-out mycerts.pfx \
-inkey private.key \
-in cert.crt \
-certfile ca-chain.crt \
-passout pass:YourExportPassword
|
|
|
|
🔹Using Windows PowerShell + certutil |
certutil -mergepfx cert.cer private.key mycerts.pfx
Or via Powershell:
$cert = Get-Item Cert:\LocalMachine\My\THUMBPRINT
$pwd = ConvertTo-SecureString -String "YourPfxPass" -AsPlainText -Force
Export-PfxCertificate -Cert $cert -FilePath .\mycerts.pfx -Password $pwd
These commands show Windows-native methods, targeting queries like “export-pfxcertificate powershell”.
| Tool | Purpose |
|---|---|
| OpenSSL | CLI tool to extract, convert, and inspect certs |
tar/zip | Archiving utilities for bundling certificate files |
keytool | Java keystore management (optional, for Java apps) |
Once you’ve extracted your .crt, .key, and ca-chain.crt files, archive them for safe storage or distribution.
Create a |
tar -czvf cert_bundle.tar.gz certificate.crt private.key ca-chain.crt
Create a |
zip cert_bundle.zip certificate.crt private.key ca-chain.crt
You may also encrypt the archive:
gpg -c cert_bundle.tar.gz
This command will prompt you for a passphrase and create a cert_bundle.tar.gz.gpg file.
.pfxBelow are step-by-step examples using OpenSSL, covering common extraction scenarios.
A. Extract Everything into a Single |
openssl pkcs12 -in mycerts.pfx -out all.pem -nodes
|
|
B. Extract Individual Components |
| Step | Command | Output File | Notes |
|---|---|---|---|
| 1 | openssl pkcs12 -in my.pfx -nocerts -out key.pem -nodes | key.pem (encrypted key) | Includes encryption or add -nodes to disable |
| 2 | openssl pkcs12 -in my.pfx -clcerts -nokeys -out cert.pem | cert.pem (public cert) | -clcerts filters only client/server certificate |
| 3 | openssl pkcs12 -in my.pfx -cacerts -nokeys -out ca.pem | ca.pem (intermediate/root chain) | Extracts the Intermediate/root certificates into one .pem |
| 4 | openssl rsa -in key.pem -out key-no-pass.pem | Decrypt private key | Outputs a password-less key |
cat cert.pem ca.pem > fullchain.pem
C. Advanced & Attribute Cleaning |
OpenSSL 3.5+ supports removing MS-specific attributes:
openssl pkcs12 -in file.pfx -nocerts -nodes | openssl rsa -out private.key
openssl pkcs12 -in file.pfx -clcerts -nokeys | openssl x509 -out pub.crt
openssl pkcs12 -in file.pfx -cacerts -nokeys | openssl x509 -out ca-chain.crt
D. Examples for Windows/Linux Users |
OpenSSL 3.5+ supports removing MS-specific attributes:
# Linux
openssl pkcs12 -in file.pfx -nocerts -nodes | openssl rsa -out private.key
openssl pkcs12 -in file.pfx -clcerts -nokeys | openssl x509 -out pub.crt
openssl pkcs12 -in file.pfx -cacerts -nokeys | openssl x509 -out ca-chain.crt
# Windows CLI using Powershell
"C:\OpenSSL-Win64\bin\openssl.exe" pkcs12 -in cert.pfx -nocerts -nodes -out cert.key
"C:\OpenSSL-Win64\bin\openssl.exe" pkcs12 -in cert.pfx -clcerts -nokeys -out cert.pem
If you need to recreate the .pfx file:
openssl pkcs12 -export \
-out rebuilt.pfx \
-inkey private.key \
-in certificate.crt \
-certfile ca-chain.crt
You’ll be prompted to enter a password for the output PFX. This can be automated for CI/CD pipelines using expect or secure secrets managers.
| Target Format | Command |
|---|---|
| PEM | openssl pkcs12 -in certificate.pfx -out fullchain.pem -nodes |
| DER | openssl x509 -in certificate.crt -outform der -out certificate.der |
| JKS (Java) | keytool -importkeystore -srckeystore certificate.pfx -srcstoretype pkcs12 \-destkeystore keystore.jks -deststoretype JKS |
You can verify your extracted certificate and key pair with:
openssl rsa -noout -modulus -in private.key | openssl md5
openssl x509 -noout -modulus -in cert.pem | openssl md5
If the output hashes match, your certificate and private key are a valid pair.
| Practice | Why It Matters |
|---|---|
| Use strong passwords | Protects the integrity of the PFX file |
| Restrict file permissions | Prevent unauthorized access to sensitive components |
| Encrypt archives | Adds another layer of defense |
| Don’t leave private keys unencrypted | Always re-encrypt with AES after extraction |
| Use environment-specific folders | Separate certs for dev/staging/prod environments |
| Audit expiration dates | Track expiration with tools like openssl x509 -enddate |
| Operation | Command Example |
|---|---|
| Extract Certificate | openssl pkcs12 -in file.pfx -clcerts -nokeys -out cert.crt |
| Extract Private Key | openssl pkcs12 -in file.pfx -nocerts -nodes -out key.key |
| Extract CA Chain | openssl pkcs12 -in file.pfx -cacerts -nokeys -out ca.crt |
| Archive Cert Files | tar -czvf certs.tar.gz cert.crt key.key ca.crt |
| Encrypt Archive | gpg -c certs.tar.gz |
| Rebuild PFX | openssl pkcs12 -export -out file.pfx -inkey key.key -in cert.crt |
|
|
Learn about securing SSH connections on RHEL 9 and CentOS 9 with Ansible roles. This guide covers key SSH security practices, Ansible playbook setup, and
In this article, we’ll explore the simple steps to enable HTTPS on your website. We’ll guide you through the process of installing SSL on RHEL9,
Learn how to implement SSL on FreeIPA servers to secure communication channels. This comprehensive guide covers obtaining, installing, and verifying SSL certificates, along with troubleshooting