What is a PFX to PEM converter?

A PFX to PEM converter opens a .pfx (PKCS#12) file using its passphrase and extracts everything inside — the certificate chain and the private key — as separate PEM files. PFX is the format IIS and Windows expect; PEM is what Apache, Nginx and most Linux tooling expect.

How do I use this PFX to PEM converter?

Select your .pfx (or .p12) fileEnter the passphrase that protects it (leave it blank if the file has none)Click convertDownload certificate.pem (every certificate found) and private.key (the private key, if the PFX contains one)

Is my PFX file safe with this tool?

Yes — and you can verify it instead of taking our word for it. The conversion runs entirely in your browser using the open-source node-forge library; the browser's built-in Web Crypto API cannot parse PKCS#12 files, which is why a library is required. Your PFX file, its passphrase and everything extracted from it never leave your device. To check: open DevTools, select the Network tab, leave the filter on All and run a conversion. You will see a request to /track — a usage counter whose payload is only the processing time (execution_ms). It is sent with sendBeacon, so it appears under ping/Other; filtering by Fetch/XHR shows nothing. No request carries your file content or passphrase.

What if my PFX has no password?

That is fine — leave the passphrase field blank. An unprotected PFX is unusual but valid, and this tool tries an empty passphrase as a legitimate value rather than rejecting it upfront. This only applies to opening an existing PFX; if you use one of our tools that builds a new PFX, a passphrase of at least 8 characters is mandatory for that new file.

Yes, this PFX to PEM converter is completely free to use at tools.bkns.vn. No registration, subscription, or payment required.

Does this tool support ECDSA keys and certificates?

Yes. Reading a PFX works regardless of the key or certificate algorithm — RSA and ECDSA both extract cleanly. This is different from BKNS's PFX-building tools (CRT/PEM/P7B to PFX), which are RSA-only today: opening an existing PFX does not have that limitation, only assembling a new one does.

PFX to PEM Converter for Apache and Nginx

This PFX to PEM converter opens a .pfx (PKCS#12) file with its passphrase and extracts every certificate and the private key it contains into separate PEM files, ready for Apache, Nginx and most Linux tooling. The conversion happens entirely in your browser, so your PFX contents never leave your device. Works with both RSA and ECDSA keys.

Processed entirely in your browser

Your files never leave your browser. The page sends only a usage counter signal containing the processing time — never any file content.

Verify this yourself

You don't have to take our word for it — check it yourself in 3 steps:

Open your browser DevTools and select the Network tab
Leave the filter on All — do not filter by Fetch/XHR
Run the conversion and look at the request list

The usage counter is sent with sendBeacon, so it appears under ping (Other) and NOT under Fetch/XHR — that is why you should not filter. You will see a request to /track carrying the processing time. No request carries your file content or passphrase.

PFX/P12 file

Passphrase of the PFX file

Leave empty if the file has no passphrase

Equivalent openssl command

If you would rather run it on your own machine, this command produces the equivalent result.

openssl pkcs12 -in certificate.pfx -out certificate.pem -nodes

How It Works

This tool opens your PFX file entirely inside your browser — the file, its passphrase and everything extracted from it never leave your device. Upload or select your .pfx (or .p12) file, enter the passphrase that protects it (leaving it blank is valid if the PFX has none), and the converter unpacks every certificate and the private key it finds.

You get two downloads: certificate.pem, containing every certificate in the file in its original order (the leaf plus any intermediates — nothing is guessed or dropped), and private.key, the private key re-wrapped as PEM. If the PFX genuinely has no private key inside (some CAs hand out certificate-only bundles), the tool still gives you the certificate file and tells you plainly that no key was found, instead of failing the whole conversion.

All processing happens locally on your device using the open-source node-forge library — the browser's built-in Web Crypto API cannot parse PKCS#12 files, which is why a library is required. This direction works with both RSA and ECDSA keys, unlike the PFX-building tools on this site, which are RSA-only today.

Common Use Cases

IIS to Apache/Nginx Migration: Move a certificate issued for a Windows server onto a Linux web server
Certificate Backup Inspection: Read the certificate and key out of a .pfx backup without special tooling installed
Automation and Config Management: Get separate PEM files that most Linux tools (Apache, Nginx, HAProxy, Ansible) expect, instead of a single PKCS#12 blob
Recovering the Chain: Extract every intermediate certificate bundled inside a PFX for reuse elsewhere
Auditing a Received PFX: Check exactly what a partner or CA packaged into a .pfx before deploying it

🔒Need an SSL certificate?

Protect your website with BKNS SSL — from 199,000đ/year, free installation

Buy SSL

Technical Background

PFX (PKCS#12) is a single binary file that carries a certificate, its private key, and optionally an intermediate chain together, encrypted under one passphrase — the format IIS and Windows Server expect. PEM is the opposite approach: a text format, Base64 wrapped between -----BEGIN----- and -----END----- lines, with each piece normally kept in its own file — what Apache, Nginx and most Linux tooling expect.

Opening a PFX means decrypting its SafeContents bags with your passphrase and re-serializing whatever is inside as PEM, without discarding or reordering anything: every certificate bag becomes a CERTIFICATE block in certificate.pem, in the order the PFX stored them. The private key gets a PEM label chosen by its actual algorithm — RSA PRIVATE KEY (PKCS#1) for RSA keys, the classic label most legacy tooling expects, or PRIVATE KEY (PKCS#8) for ECDSA and other algorithms the underlying library does not fully parse into its own object model but can still re-encode losslessly.

All of this runs in your browser using the open-source node-forge library, because the browser's built-in Web Crypto API cannot parse PKCS#12 structures at all. A wrong passphrase is detected explicitly (PFX files carry an integrity MAC over the whole structure) rather than surfacing a raw parser error.