What is a PFX to CRT converter?

A PFX to CRT converter opens a .pfx (PKCS#12) file using its passphrase and extracts just the leaf server certificate as a standalone .crt file — equivalent to openssl pkcs12 -clcerts -nokeys. If you need the full chain and the private key too, use PFX to PEM instead.

How do I use this PFX to CRT converter?

Select your .pfx (or .p12) fileEnter the passphrase that protects it (leave it blank if the file has none)Click convertDownload certificate.crt — the leaf server certificate

Is my PFX file safe with this tool?

Yes — and you can verify it instead of taking our word for it. The conversion runs entirely in your browser using the open-source node-forge library; the browser's built-in Web Crypto API cannot parse PKCS#12 files, which is why a library is required. Your PFX file, its passphrase and the extracted certificate never leave your device. To check: open DevTools, select the Network tab, leave the filter on All and run a conversion. You will see a request to /track — a usage counter whose payload is only the processing time (execution_ms). It is sent with sendBeacon, so it appears under ping/Other; filtering by Fetch/XHR shows nothing. No request carries your file content or passphrase.

Why did the tool refuse to convert my PFX?

If your PFX contains several certificates and the tool cannot tell which one is the leaf (the server certificate), it refuses rather than guessing — returning the wrong certificate silently would be worse than an error. This happens when the PFX has no private key to match against, or when the matching attribute is missing or matches more than one certificate. Use PFX to PEM instead: it returns every certificate found, and you can pick the right one yourself.

Yes, this PFX to CRT converter is completely free to use at tools.bkns.vn. No registration, subscription, or payment required.

Does this tool support ECDSA certificates?

Yes. Reading a PFX works regardless of the certificate or key algorithm — RSA and ECDSA both extract cleanly. This is different from BKNS's PFX-building tools (CRT/PEM/P7B to PFX), which are RSA-only today: opening an existing PFX does not have that limitation.

PFX to CRT Converter — Extract the Server Certificate

This PFX to CRT converter opens a .pfx (PKCS#12) file with its passphrase and extracts just the leaf server certificate as a .crt file. The conversion happens entirely in your browser, so your PFX contents never leave your device. Works with both RSA and ECDSA certificates.

Processed entirely in your browser

Your files never leave your browser. The page sends only a usage counter signal containing the processing time — never any file content.

Verify this yourself

You don't have to take our word for it — check it yourself in 3 steps:

Open your browser DevTools and select the Network tab
Leave the filter on All — do not filter by Fetch/XHR
Run the conversion and look at the request list

The usage counter is sent with sendBeacon, so it appears under ping (Other) and NOT under Fetch/XHR — that is why you should not filter. You will see a request to /track carrying the processing time. No request carries your file content or passphrase.

PFX/P12 file

Passphrase of the PFX file

Leave empty if the file has no passphrase

Equivalent openssl command

If you would rather run it on your own machine, this command produces the equivalent result.

openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out certificate.crt

How It Works

This tool opens your PFX file entirely inside your browser — the file, its passphrase and the extracted certificate never leave your device. Upload or select your .pfx (or .p12) file and enter the passphrase that protects it (leaving it blank is valid if the PFX has none). The converter unpacks every certificate inside and returns exactly one: the leaf, the certificate that identifies your server — equivalent to openssl pkcs12 -clcerts -nokeys.

If the PFX contains only one certificate, that one is returned without ambiguity. If it contains several — a leaf plus intermediates, the normal case for a PFX exported with a full chain — the tool identifies the leaf by matching it against the private key's localKeyId attribute, the same way OpenSSL does. If that match is not unambiguous (no private key in the file, or the attribute is missing or matches more than one certificate), the tool refuses to guess and tells you to use PFX to PEM instead, which returns every certificate found rather than picking one.

All processing happens locally on your device using the open-source node-forge library — the browser's built-in Web Crypto API cannot parse PKCS#12 files, which is why a library is required. This direction works with both RSA and ECDSA certificates, unlike the PFX-building tools on this site, which are RSA-only today.

Common Use Cases

Pinning or Trust Configuration: Get just the leaf certificate to configure certificate pinning or a trust store entry
Quick Certificate Inspection: Pull the server certificate out of a .pfx to check its subject, SANs or expiry with a decoder tool, without the intermediates in the way
Reissuing a CSR: Extract the current certificate to compare against a renewal before installing it
API and Client Configuration: Some clients (and reverse proxies) want just the server certificate, not a full chain bundle
Auditing a Received PFX: Confirm which certificate a partner or CA actually bound to the private key in a .pfx they sent you

🔒Need an SSL certificate?

Protect your website with BKNS SSL — from 199,000đ/year, free installation

Buy SSL

Technical Background

A PFX (PKCS#12) file can bundle any number of certificates in its SafeContents — typically one leaf certificate (the one bound to the private key) plus the intermediates that complete the chain to a trusted root. Only the leaf identifies your server; the rest exist purely to help clients build a trust path. CRT is simply that one certificate, re-wrapped as a standalone PEM-armored file.

OpenSSL and every major PKCS#12 implementation attach a localKeyId attribute to the certificate bag that goes with the private key at export time — certificates added only as chain material (via -certfile, for example) do not get one. This tool uses that same attribute to identify the leaf when a PFX holds more than one certificate: it matches the key's localKeyId against every certificate bag and returns the single match. If there is no private key to match against, or the attribute is absent, or more than one certificate matches, there is no reliable signal left to pick one — so the tool raises an explicit error (PFX_AMBIGUOUS_LEAF) instead of guessing. That is a deliberate design choice, not a limitation to work around: silently returning the wrong certificate would be worse than refusing.

All of this runs in your browser using the open-source node-forge library, because the browser's built-in Web Crypto API cannot parse PKCS#12 structures at all.