CERTIFICATE WORKSHOP / PKCS#12 · 7 MIN READ

Build a PFX with the Certificate, Key and CA Chain.

A PFX is a container, not a new certificate. It can carry your leaf certificate, its matching private key and the CA certificates needed by the destination.

Run these commands locally. Replace aboutssl.info with a domain you control. Use a new, access-restricted working folder and review output filenames before running anything; OpenSSL can overwrite them. Never paste a private key or PFX password into this website, chat, email, or a ticket.

Know the Four Inputs

Never include a CA’s private key. “CA” in this bundle means the public CA certificates. A normal web server serves the leaf and intermediate certificates; clients already need an independently trusted root.

1. Make Sure the Certificate Matches the Key

Compare SHA-256 fingerprints of their normalized public keys. These temporary files contain only public material. File-based conversion avoids binary pipeline problems in older PowerShell versions.

openssl x509 -in leaf.pem -pubkey -noout -out cert-public.pem
openssl pkey -pubin -in cert-public.pem -outform DER -out cert-public.der
openssl pkey -in aboutssl.info.key.pem -pubout -outform DER -out key-public.der
openssl dgst -sha256 cert-public.der key-public.der

The two hashes must be identical. If not, stop and find the original matching key. Converting formats cannot repair a mismatch or recreate a lost private key.

2. Verify the Issuer Path

Obtain CA certificates through an authenticated source and verify the root fingerprint independently. This command checks against the specific root you supply; it does not establish that all browsers trust that root.

openssl verify -purpose sslserver -verify_hostname aboutssl.info -CAfile root.pem -untrusted intermediates.pem leaf.pem

A successful result is leaf.pem: OK. Fix missing intermediates, wrong issuer paths, name mismatches or date failures before packaging. This example does not check certificate revocation.

3. Assemble the Extra Certificates

If the destination explicitly needs the root in the PFX, combine intermediate certificates and the root below. If it only needs intermediates, use intermediates.pem directly as the -certfile input in step 4. Do not add unrelated or duplicate certificates.

cat intermediates.pem root.pem > ca-chain.pem

Get-Content -LiteralPath .\intermediates.pem, .\root.pem |
    Set-Content -LiteralPath .\ca-chain.pem -Encoding ascii

4. Create the Password-protected PFX

openssl pkcs12 -export -out aboutssl.info.pfx -inkey aboutssl.info.key.pem -in leaf.pem -certfile ca-chain.pem -name aboutssl.info

OpenSSL asks for the encrypted input-key passphrase and then the PFX export password. They can be different. Use the modern default protection and transfer the password separately from the PFX.

-in selects the leaf, -inkey selects its private key, and -certfile adds CA certificates. Adding a root to the file does not make it trusted. The import destination controls trust and which certificates it installs.

5. Inspect Before You Import

openssl pkcs12 -in aboutssl.info.pfx -info -noout

• Confirm the leaf identity and chain membership, not just the filename.
• Protect the resulting PFX like a private key. Do not upload it to online conversion tools.
• Check the target’s supported PFX algorithms. Do not automatically weaken encryption to solve an import error.
• After importing, verify the service has its private key and binds the intended certificate. Inspect the public endpoint again.

For a certificate already associated with a private key in Windows, use the PowerShell certificate-store export. A .cer file alone cannot supply a missing key.