aethercert
Documentation

Convert certificate files - CER, CRT, PEM and KEY to PFX and back

Convert CER or CRT plus KEY to PFX, or split a PFX into .cer, .crt, full chain and .key. The key is checked against the certificate first. 3DES for old Windows Server.

Convert files converts certificate files that are not in the Windows certificate store. It does two things:

  • Build a PFX: combine an issued certificate, its chain and the private key into one password-protected .pfx (PKCS#12) - the form IIS, Exchange and most appliances import.
  • Take a certificate or PFX apart: write .cer, .crt/.pem, full chain, chain only or .key - for nginx, Apache, HAProxy, Java and appliances that want separate PEM files.

The source files are never changed. Certificates that are already in the store are exported from the certificate list instead. On the command line it is actk pfx and actk export.

Open it with Convert files … in the certificate list's toolbar. The workflow has five steps: Source, Formats, Options, Review and convert and Result.

Convert CER or CRT and KEY to PFX

  1. Source - choose Certificate & key files.

    • Certificate: the issued certificate, PEM or DER (.cer, .crt, .pem). It may already contain the chain. PKCS#7 (.p7b) chains are read as well.
    • Intermediate certificates (optional): the chain, if the CA sent it separately.
    • Private key: the .key file saved with the CSR - PKCS#8 or PKCS#1 PEM, encrypted or not (enter its password).

    The toolkit checks that the certificate and the private key belong together before it continues, so a PFX never pairs the wrong key.

  2. Formats - tick .pfx / .p12, or use the Windows / IIS / Exchange preset.

  3. Options - the file name, the friendly name Windows shows (defaults to the common name), the password, and Compatible with Windows Server 2016 and older (3DES instead of AES-256) when the PFX goes to Windows Server 2016 or earlier, which cannot import an AES-256 PFX.

  4. Review and convert, then Choose folder and convert ….

Convert PFX to CER, CRT, PEM or KEY

  1. Source - choose Open a PFX (for example one exported from IIS or the Windows certificate store) and enter its password.

  2. Formats - tick what the target needs, or use a preset:

    PresetWrites
    nginx / Apache / HAProxy<name>-fullchain.pem and <name>.key
    Certificate only<name>.cer and <name>.crt
    FormatContent
    .cerCertificate, DER (binary) - Windows' default export, Java keytool, many appliances
    .crtCertificate, PEM (Base64) - Linux, nginx/Apache, web forms
    Full chainCertificate and chain, PEM - nginx, Apache 2.4.8+, HAProxy
    Chain onlyThe intermediates, PEM - servers that take the chain separately
    .keyPrivate key, PKCS#8 PEM

  3. Options - Encrypt the .key with a password (recommended) is on by default. Turn it off only for a server that cannot read an encrypted key; the key is then written in clear text and anyone with the file can use it.

  4. Review and convert, then Choose folder and convert ….

A certificate without a private key converts to every certificate format; .pfx and .key need the key.

Files are never overwritten

If any of the files already exists in the chosen folder, nothing is written. Go back and change the name or the folder. (actk overwrites only where you pass --force.) The result step lists every file written, with Show in folder.

On this page

Convert CER or CRT and KEY to PFXConvert PFX to CER, CRT, PEM or KEYFiles are never overwritten