PFX Generator

What we check before building the file

• That the key matches the certificate — the most common mistake. A PFX with the wrong key works nowhere, so we stop there.
• The chain order: the intermediates go in the right order however you paste them, and we tell you if the one that issued your certificate is missing or if one does not belong to the chain.
• The dates: whether the certificate or an intermediate has expired.
• Mixed-up fields: if you paste everything into one box (e.g. a fullchain.pem with the key), we sort it out. If you paste a CSR instead of the certificate, or an SSH key, we tell you.

We accept RSA, ECDSA (P-256, P-384, P-521) and Ed25519 keys, in PKCS#8 (BEGIN PRIVATE KEY), RSA (BEGIN RSA PRIVATE KEY) or EC (BEGIN EC PRIVATE KEY) format — encrypted ones too (BEGIN ENCRYPTED PRIVATE KEY or Proc-Type: 4,ENCRYPTED) with AES or 3DES. Certificates are also accepted in binary form (DER, .cer) and as .p7b.

TripleDES-SHA1 or AES256-SHA256?

These are the two encryption choices you also see in the Windows export wizard. If you change nothing, the tool uses TripleDES-SHA1, which opens on every system, old ones included: Windows Server 2016 and earlier, Java 8, older Android devices. AES256-SHA256 (the OpenSSL 3 default) is stronger, but only Windows 10 (1709) / Server 2019 and later understand it. On older Windows, an AES PFX gives the misleading message "The password you entered is incorrect", even when the password is right.

With OpenSSL on your own server

The same conversion in one command (under "Advanced" you see it with your own details):

openssl pkcs12 -export -out example.com.pfx -inkey example.com.key -in example.com.crt -certfile ca-bundle.crt

If you do not have a certificate yet, start with the CSR Generator. After installing, check the result with the SSL Checker.

The site opens on your computer, but not on phones and apps

After installing on IIS, the office browser shows the padlock as usual, but some phones, apps or services that connect to the server report a trust error. Usually the PFX was built with the certificate only, without the intermediates: some browsers complete the chain on their own, other clients do not. If you leave the CA Bundle empty, the tool notes it and names the missing issuer; if you add the wrong bundle, it warns you that the intermediate that issued your certificate is not in it.

Fix: download the correct bundle from your Certificate Authority, build the PFX again with it, re-import it in IIS and confirm with the SSL Checker that the chain is complete.

Renewal: the old and the new certificate both ended up in the field

During a renewal it is easy to paste everything in the folder: the new certificate, last year's one and the intermediates. The tool keeps the one that matches the key as the main certificate and warns you about any certificate that is not part of its chain — usually the old one. If the validity in the summary shows the old expiry date, you have also pasted the old key.

Fix: remove the certificate that is not part of the chain from the field, so it does not end up in the PFX for no reason, and use the key that was created with the renewal CSR.

In IIS you cannot tell the new certificate from the old one

After importing the new PFX, the IIS Server Certificates list and the choice in Bindings show entries with the same name. Windows displays the file's friendly name, and if you do not set one, the tool uses the domain.

Fix: under "Advanced", enter a friendly name that stands out, e.g. example.com 2026, build the PFX again and import it. Pick it in Bindings and, once you are sure it works, remove the old one.