Skip to main content

Combine a Certificate and Private Key into a P12 / PFX File

A certificate and its corresponding private key can be combined into a PKCS#12 file.

PKCS#12 files commonly use the following extensions:

  • .p12
  • .pfx

Both extensions use the same PKCS#12 format.

Assume the following files are available:

  • server.crt
  • server.key

Create the PKCS#12 file with:

openssl pkcs12 -export -out server.pfx -inkey server.key -in server.crt

OpenSSL prompts for an export password:

Enter Export Password: 
Verifying - Enter Export Password:

The password protects the private key contained in the PFX file.

The resulting file is:

server.pfx

Set a Friendly Name​

An optional friendly name can be assigned to the certificate:

openssl pkcs12 -export -out server.pfx -inkey server.key -in server.crt -name "server.example.com"

The friendly name can make the certificate easier to identify when importing it into systems such as Windows or IIS.

Verify the PFX File​

Display information about the PKCS#12 file:

openssl pkcs12 -info -in server.pfx -noout

OpenSSL prompts for the password that was specified when the file was created.

To display the certificates contained in the PFX file without displaying the private key:

openssl pkcs12 -in server.pfx -nokeys

Security Considerations​

warning

A PFX/P12 file contains the private key and must therefore be handled securely.

Store the file in a protected location and use a strong export password. Do not distribute the PFX file unless the receiving system requires access to the private key.