BKNS Network Tools

Search tools... (WHOIS, DNS, SSL, Ping...)

Search through available tools

CRT to PFX Converter for IIS and Windows

This CRT to PFX converter combines your CRT certificate and private key into a single .pfx file ready for IIS and Windows Server deployment. The conversion happens entirely in your browser, so your certificate and private key never leave your device. Built for system administrators who received a CRT certificate from a CA and need it packaged in PKCS#12 format for Windows infrastructure.

Processed entirely in your browser

Your files never leave your browser. The page sends only a usage counter signal containing the processing time — never any file content.

Verify this yourself

You don't have to take our word for it — check it yourself in 3 steps:

  1. Open your browser DevTools and select the Network tab
  2. Leave the filter on All — do not filter by Fetch/XHR
  3. Run the conversion and look at the request list

The usage counter is sent with sendBeacon, so it appears under ping (Other) and NOT under Fetch/XHR — that is why you should not filter. You will see a request to /track carrying the processing time. No request carries your file content or passphrase.

or paste the content

The block starting with -----BEGIN CERTIFICATE-----

or paste the content

The private key matching the certificate above

or paste the content

Intermediate CA certificates, pasted one after another

BKNS does not store this passphrase and cannot recover it — no server ever sees it. Save it before you download the file.

Encryption algorithm

Equivalent openssl command

If you would rather run it on your own machine, this command produces the equivalent result.

openssl pkcs12 -export -out certificate.pfx -inkey private.key -in certificate.crt -certfile ca-bundle.crt

How It Works

This tool processes CRT certificates and private keys entirely inside your browser — the certificate, key and passphrase never leave your device. Upload or paste your CRT certificate file and private key, then the converter combines them into PKCS#12 (.pfx) format, the standard certificate format for IIS and Windows systems.

If you also have an intermediate/CA bundle, add it in the optional chain field — the tool orders it behind your certificate automatically. You must set a passphrase (at least 8 characters) to protect the .pfx file; you will need that same passphrase when importing it into IIS.

All processing happens locally on your device using the open-source node-forge library — the browser's built-in Web Crypto API cannot produce PKCS#12 files, which is why a library is required. The PFX builder supports RSA keys only; if your private key is ECDSA, the page tells you as soon as it loads the key file, before you type a passphrase.

Common Use Cases

  • IIS SSL Installation: Convert a CRT certificate issued by DigiCert, Sectigo or another CA into .pfx format for binding to IIS websites
  • Windows Server Deployment: Prepare certificates for Windows Server web hosting and Remote Desktop Services
  • Certificate Migration: Move a CRT + key pair issued for a Linux/Apache server onto Windows infrastructure
  • CA Bundle Packaging: Combine a CRT leaf certificate with its intermediate chain into a single importable .pfx
  • Certificate Renewal: Package a freshly renewed CRT certificate for re-import into IIS
🔒Need an SSL certificate?

Protect your website with BKNS SSL — from 199,000đ/year, free installation

Buy SSL

Technical Background

CRT and PFX are two different ways of packaging the same certificate material. CRT is a text-based X.509 certificate — the same PEM-armored format as a .pem or .cer file, just carrying a different file extension by convention. It holds only the public certificate, not the private key, and is what Apache, Nginx and most Linux tooling expect as one piece of a multi-file bundle. PFX is a single binary file (PKCS#12) that carries the certificate, its private key, and optionally the intermediate chain together, encrypted under one passphrase — the format IIS and Windows Server expect.

Converting is a re-packaging, not a re-encoding: the CRT certificate and your separate private key file are assembled into one PKCS#12 structure. This tool checks that the certificate and key actually belong to the same key pair before building anything, and reports it plainly if they do not match — far easier to fix now than after a failed IIS import. The default encryption is 3DES (pbeWithSHAAnd3-KeyTripleDES-CBC), the PKCS#12 encryption Windows has read for two decades and what openssl pkcs12 -export -legacy produces; AES-256 is available as an advanced option.

All of this runs in your browser using the open-source node-forge library, because the browser's built-in Web Crypto API has no PKCS#12 support at all. The PFX builder handles RSA keys only today — an ECDSA key is detected as soon as you load it and rejected with a link to the equivalent OpenSSL command, before you type a passphrase.

Frequently Asked Questions