What is a P7B to PFX converter?

A P7B to PFX converter unpacks a PKCS#7 (.p7b) certificate bundle, pairs it with a private key you provide, and combines both into a single PKCS#12 (.pfx) file. P7B never contains a private key on its own — PFX does, which is why IIS and Windows Server require it for a working HTTPS binding.

How do I use this P7B to PFX converter?

Paste or upload your P7B bundle (.p7b or .p7c extension)Paste or upload your private key file (.key extension)Enter a passphrase to protect the .pfx file (required, at least 8 characters) and re-enter it to confirmClick convert and download your .pfx fileImport the .pfx file into IIS using the Certificates snap-in or IIS Manager

Is my private key safe with this tool?

Yes — and you can verify it instead of taking our word for it. The conversion runs entirely in your browser using the open-source node-forge library; the browser's built-in Web Crypto API cannot produce PKCS#12 files, which is why a library is required. Your P7B bundle and private key never leave your device. To check: open DevTools, select the Network tab, leave the filter on All and run a conversion. You will see a request to /track — a usage counter whose payload is only the processing time (execution_ms). It is sent with sendBeacon, so it appears under ping/Other; filtering by Fetch/XHR shows nothing. No request carries file content or your passphrase.

What passphrase should I use for the PFX file?

A passphrase is required — at least 8 characters — because a PFX file without one is an unprotected private key. Use a strong one if you plan to store or transfer the file; the tool can generate one for you. You will need this same passphrase when importing into IIS. BKNS does not store it and cannot recover it, so save it before you download the file.

Yes, this P7B to PFX converter is completely free to use at tools.bkns.vn. No registration, subscription, or payment required.

What happens if my P7B bundle contains multiple certificates?

That's the normal case — a P7B almost always bundles the leaf certificate together with one or more intermediates. The tool matches your private key against each certificate in the bundle to identify the leaf, then orders the rest as the chain automatically. You do not need to separate them yourself, and there is no separate chain field for this direction — the P7B already carries everything.

P7B to PFX Converter for IIS and Windows

This P7B to PFX converter combines your P7B certificate chain and private key into a single .pfx file ready for IIS and Windows Server deployment. The conversion happens entirely in your browser, so your certificate chain and private key never leave your device. Built for administrators who received a P7B bundle from a CA and need it packaged with the matching private key for Windows infrastructure.

Processed entirely in your browser

Your files never leave your browser. The page sends only a usage counter signal containing the processing time — never any file content.

Verify this yourself

You don't have to take our word for it — check it yourself in 3 steps:

Open your browser DevTools and select the Network tab
Leave the filter on All — do not filter by Fetch/XHR
Run the conversion and look at the request list

The usage counter is sent with sendBeacon, so it appears under ping (Other) and NOT under Fetch/XHR — that is why you should not filter. You will see a request to /track carrying the processing time. No request carries your file content or passphrase.

Certificate bundle P7B (PKCS#7)

A PKCS#7 file containing one or more certificates, usually with a .p7b or .p7c extension — typically emailed by your CA, not a plain PEM block

Private key

or paste the content

The private key matching the certificate above

Passphrase protecting the PFX file

Re-enter the passphrase

BKNS does not store this passphrase and cannot recover it — no server ever sees it. Save it before you download the file.

Encryption algorithm

Equivalent openssl command

If you would rather run it on your own machine, this command produces the equivalent result.

openssl pkcs7 -in certificate.p7b -print_certs -out certificate.pem && openssl pkcs12 -export -out certificate.pfx -inkey private.key -in certificate.pem

How It Works

This tool processes P7B certificate bundles and private keys entirely inside your browser — the certificate chain, key and passphrase never leave your device. Upload or paste your P7B file (it typically already bundles your certificate and any intermediates in one PKCS#7 structure) and your private key, then the converter unpacks the bundle and rebuilds it as PKCS#12 (.pfx) format, the standard certificate format for IIS and Windows systems.

A P7B never contains a private key, so you always provide it separately here. If the bundle has more than one certificate, the tool identifies which one is the leaf by matching it against your private key, and orders the rest as the chain automatically — you do not need a separate chain field for this direction. You must set a passphrase (at least 8 characters) to protect the .pfx file; you will need that same passphrase when importing it into IIS.

All processing happens locally on your device using the open-source node-forge library — the browser's built-in Web Crypto API cannot produce PKCS#12 files, which is why a library is required. The PFX builder supports RSA keys only; if your private key is ECDSA, the page tells you as soon as it loads the key file, before you type a passphrase.

Common Use Cases

IIS SSL Installation: Convert a P7B bundle issued by DigiCert, Sectigo, or a Windows CA into .pfx format for binding to IIS websites
Windows Server Deployment: Prepare a certificate chain and key for Windows Server web hosting and Remote Desktop Services
Certificate Authority Handoff: Many internal/enterprise CAs (Microsoft ADCS, for example) export P7B by default — pair it with your private key here to get an installable PFX
Certificate Migration: Move a P7B chain issued for another platform onto Windows infrastructure
Certificate Renewal: Package a freshly renewed P7B bundle with your existing private key for re-import into IIS

🔒Need an SSL certificate?

Protect your website with BKNS SSL — from 199,000đ/year, free installation

Buy SSL

Technical Background

P7B (PKCS#7) and PFX (PKCS#12) are both binary certificate containers, but they carry different material. A P7B is a SignedData structure that bundles one or more certificates — typically a leaf plus its intermediates — with no private key at all; it is what Microsoft CAs and many enterprise PKI tools export by default. A PFX bundles a certificate, its private key, and optionally the chain together, encrypted under one passphrase — the format IIS and Windows Server expect for a working HTTPS binding.

To build the PFX, this tool first unpacks every certificate stored in the certificates [0] IMPLICIT SET OF Certificate field of the P7B's SignedData structure. If the bundle holds more than one certificate, it matches your private key against each one to find the leaf — the certificate the key actually belongs to — and orders the remaining certificates as the chain behind it. It then assembles the leaf, chain and key into one PKCS#12 structure. The default encryption is 3DES (pbeWithSHAAnd3-KeyTripleDES-CBC), the PKCS#12 encryption Windows has read for two decades; AES-256 is available as an advanced option.

All of this runs in your browser using the open-source node-forge library, because the browser's built-in Web Crypto API has no PKCS#12 support at all. The PFX builder handles RSA keys only today — an ECDSA key is detected as soon as you load it and rejected with a link to the equivalent OpenSSL command.