What is a PEM to PFX converter?

A PEM to PFX converter combines separate PEM certificate and private key files into a single PKCS#12 (.pfx) file. PEM format is common on Linux systems, while PFX is the standard format for IIS and Windows. This tool automates the conversion process securely in your browser.

How do I use this PEM to PFX converter?

Paste or upload your PEM certificate file (usually .crt or .pem extension)Paste or upload your private key file (.key or .pem extension)Enter a passphrase to protect the .pfx file (required, at least 4 characters) and re-enter it to confirmClick convert and download your .pfx fileImport the .pfx file into IIS using the Certificates snap-in or IIS Manager

Is my private key safe with this tool?

Yes — and you can verify it instead of taking our word for it. The conversion runs entirely in your browser using the open-source node-forge library; the browser's built-in Web Crypto API cannot produce PKCS#12 files, which is why a library is required. Your certificate, private key and passphrase never leave your device. To check: open DevTools, select the Network tab, leave the filter on All and run a conversion. You will see a request to /track — a usage counter whose payload is the processing time. It is sent with sendBeacon, so it appears under ping/Other; filtering by Fetch/XHR shows nothing. No request carries file content or your passphrase.

What passphrase should I use for the PFX file?

A passphrase is required — at least 4 characters — because a PFX file without one is an unprotected private key. Use a strong one if you plan to store or transfer the file; the tool can generate one for you. You will need this same passphrase when importing into IIS. BKNS does not store it and cannot recover it, so save it before you download the file.

Yes, this PEM to PFX converter is completely free to use at tools.bkns.vn. No registration, subscription, or payment required.

Does this tool support ECDSA keys?

Not yet. The PFX builder supports RSA keys. If your certificate uses an ECDSA key, the page tells you as soon as you load the file — rather than letting you type a passphrase and fail afterwards — and gives you the equivalent OpenSSL command to build the PFX yourself:openssl pkcs12 -export -out certificate.pfx -inkey private.key -in certificate.crt -certfile chain.crtConversions that never touch the private key (PEM ↔ DER, PEM ↔ CRT) work fine with ECDSA certificates.

Convert PEM to PFX for IIS

Convert PEM certificates to PFX format instantly with our secure browser-based tool. Combine your SSL certificate and private key into a single .pfx file ready for IIS/Windows deployment. All processing happens locally on your device—your cryptographic keys never leave your computer.

Processed entirely in your browser

Your files never leave your browser. The page sends only a usage counter signal containing the processing time — never any file content.

Verify this yourself

You don't have to take our word for it — check it yourself in 3 steps:

Open your browser DevTools and select the Network tab
Leave the filter on All — do not filter by Fetch/XHR
Run the conversion and look at the request list

The usage counter is sent with sendBeacon, so it appears under ping (Other) and NOT under Fetch/XHR — that is why you should not filter. You will see a request to /track carrying the processing time. No request carries your file content or passphrase.

Certificate (PEM/CRT)

or paste the content

The block starting with -----BEGIN CERTIFICATE-----

Private key

or paste the content

The private key matching the certificate above

Intermediate chain (optional)

or paste the content

Intermediate CA certificates, pasted one after another

Passphrase protecting the PFX file

Re-enter the passphrase

BKNS does not store this passphrase and cannot recover it — no server ever sees it. Save it before you download the file.

Encryption algorithm

Equivalent openssl command

If you would rather run it on your own machine, this command produces the equivalent result.

openssl pkcs12 -export -out certificate.pfx -inkey private.key -in certificate.crt -certfile chain.crt

How It Works

This tool processes PEM certificates and private keys entirely inside your browser — the certificate, key and passphrase never leave your device. Upload or paste your PEM certificate file and private key, then the converter combines them into PKCS#12 (.pfx) format, which is the standard certificate format for IIS and Windows systems.

The conversion follows the standard PKCS#12 specification, maintaining full compatibility with IIS, Windows Server, and other Windows-based applications. You must set a passphrase (at least 4 characters) to protect the .pfx file; you will need that same passphrase when importing it into IIS.

All processing happens locally on your device using the open-source node-forge library — the browser's built-in Web Crypto API cannot produce PKCS#12 files, which is why a library is required. Your private keys never touch any server. You maintain complete control and security over your certificate data throughout the entire conversion process.

Common Use Cases

IIS SSL Installation: Convert Let's Encrypt or other PEM certificates to .pfx format for binding to IIS websites
Windows Server Deployment: Prepare certificates for Windows Server web hosting and remote desktop services
Certificate Migration: Move certificates from Linux/Apache systems to Windows infrastructure
Wildcard Certificate Setup: Bundle wildcard PEM certificates with private keys for multi-domain IIS binding
CSR and Certificate Combination: Merge certificate authority responses with private keys generated on non-Windows systems

🔒Need an SSL certificate?

Protect your website with BKNS SSL — from 199,000đ/year, free installation

Buy SSL

Technical Background

PEM (Privacy Enhanced Mail) and PFX (Personal Information Exchange, also called PKCS#12) are two different ways of packaging the same certificate material. PEM is a text format — Base64 wrapped between -----BEGIN----- and -----END----- lines — and it keeps each piece in its own file: the certificate, the private key, and the intermediate chain. It is what Apache, Nginx and most Linux tooling expect. PFX is a single binary file that carries all of those pieces together, encrypted under one passphrase, and it is what IIS and Windows Server expect.

Converting is therefore not a re-encoding but a re-packaging: the separate PEM pieces are assembled into one PKCS#12 structure. Two details decide whether the resulting file installs cleanly on Windows. First, the certificate and the private key must actually belong to the same key pair — this tool checks that before building anything and tells you plainly if they do not match, which is far easier to fix now than after a failed import. Second, the encryption algorithm: the default here is 3DES (pbeWithSHAAnd3-KeyTripleDES-CBC), the PKCS#12 encryption Windows has read for two decades and what openssl pkcs12 -export -legacy produces; AES-256 is available as an advanced option if your compliance rules require it.

All of this runs in your browser using the open-source node-forge library. A library is required rather than optional: the browser's built-in Web Crypto API has no PKCS#12 support at all, so there is no way to build a .pfx file with native browser APIs. Your private key is never sent anywhere.

Convert PEM to PFX for IIS

How It Works

Common Use Cases

Technical Background

Frequently Asked Questions

What is a PEM to PFX converter?

How do I use this PEM to PFX converter?

Is my private key safe with this tool?

What passphrase should I use for the PFX file?

Is this tool free?

Does this tool support ECDSA keys?