Certificates & Formats

What Is PKCS#12 / P12 / PFX?

PKCS#12 is the standard container format that packages a certificate, its private key and usually the CA chain into a single password-protected file — with the extensions .pfx or .p12 (the names are interchangeable). It is the only mainstream certificate format that carries the private key, which makes it both the standard way to move a certificate between systems and a file worth guarding carefully.

When you meet PFX files

Windows IIS imports and exports certificates as PFX. Code-signing certificates are delivered as PFX. Migrating a certificate from one server to another, importing into Azure Key Vault or a load balancer, or backing up a certificate with its key — all PFX. If a workflow needs certificate and key in one artifact, PKCS#12 is the answer.

Security properties — and limits

The contents are encrypted with a password-derived key. Modern tooling uses AES-256; legacy PFX files may use weak 40-bit RC2 encryption from the 1990s, and some old exports effectively protect only the key, not the certificates. Treat the password as a real secret (a short one is brute-forceable offline), prefer modern encryption when exporting, and delete transfer copies after import — a PFX on a file share is a private key on a file share.

Working with PFX files

Everything is a one-liner: create a PFX from PEM parts, or unpack a PFX back to PEM certificate, key and chain.

openssl pkcs12 -export -in cert.pem -inkey key.pem -certfile chain.pem -out bundle.pfx
openssl pkcs12 -in bundle.pfx -nodes -out everything.pem

Try it yourself — free tools

Certificate Converter — convert PEM to PFX and back without memorizing OpenSSL flags
Key Matcher — confirm certificate and key belong together before exporting a PFX

How MI Support IT can help

PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.