How to Generate a Certificate in PFX Format

A PFX is the backup copy that has the private key of a certificate from Internet Explorer. To generate a certificate in PFX format, the servers Windows and your IIS web servers must install the non-standard .pfx certificate file formats.

After issuing the certificate you purchased, you can download PEM files (.crt, .ca-bundle), which may not be sufficient for installation on Windows hosting. If you take an encrypted .pfx file, it stores the private key (.key), certificate (.crt) and certificate chain (.ca-bundle).

Steps to generate a certificate in PFX format

Here we show you what you need to generate a certificate in PFX format. We bring you instructions for these and other situations. You can create PFC with OpenSSL, this is a library (program) available in all OS Unix. If you have a server Linux or you work on a Linux-based program, you will definitely find OpenSSL as an option.

You may also like: 8 Programs to Make Personalized Diplomas or Certificates

• Step 1: In OpenSSL, you need to transfer the separately saved key to a PFX (PKCS#12) file. You can do this with the following command: openssl pkcs12 -export -in linux_cert+ca.pem -inkey privateekey.key -out output.pfx
• Step 2: After entering the password that protects the certificate, it creates an output.pfx file in the address book in which it is located.
• Step 3: Select the name after the previous command.

Steps to generate a certificate in PFX format on a Windows server (server with IIS)

• Step 1: Purchase PFX of existing certificate, in Windows operating system, you can export an existing certificate from the certificate store as a PFX file using the MMC console. 
• Step 2: You can also opt for this procedure in the case of a Windows web server, if the IIS places certificates in the certificate store.

The IIS web server allows you to export the existing certificate in PFX directly from the list of certificates on the server. The private key and CSR code are generated during the creation of the CSR request in IIS, and after issuance, the certificate is imported there.

Exporting is very easy, you need to right click on the corresponding certificate and select Export. After entering the password that protects the PFX file, The certificate is stored on the data carrier.

Can I import a new certificate and create a PFX?

Unfortunately this procedure is not possible. The certificate store in Windows does not support importing the private key via a file, so you cannot connect the keys to PFX in the MMC console as with OpenSSL. Again, you can only import the PFX to the IIS web server.

If you want to import a new certificate on the Windows server and the private key is not on the server (you did not create the CSR request on the server), you can proceed as follows:

• Create the PFX elsewhere (for example, in OpenSSL) and then import the certificate with PFX.
• Create a new request (CSR request) on the server and reissue the certificate.

Reissue means that the certificate will be reissued for free and you can import it to the existing private key. You can perform this operation yourself in the customer administration.

How to generate a certificate in PFX format in a third-party application?

You can create the PFX file from separate keys in a graphical program and thus avoid using command lines in OpenSSL. We recommend the open source application XCA as the best program for this purpose. In this intuitive program you can manage all your certificates and keys.

The main advantage is the automatic assignment of keys to each other, you don't have to research which private key matches which certificate. Importing keys is easy and exporting in all formats is possible.

Maybe you might be interested: SKP files – What they are, features, how to open them

When might you need PFX?

There are different circumstances in which you may need PFX and here's why it's important:

• You want to install the certificate on the Windows server (in IIS Manager), but the CSR key was not created in IIS.
• You need the certificate for Windows server, but the IIS to generate CSR is not available for you.
• You have created the CSR key in the SSL market and saved the private key. Now you want to use the certificate on the Windows server.
• You have purchased a code signing certificate and need the PFX file to sign.

Is PFX file safe?

The PFX file is always password protected because it contains the private key. When creating the file, choose the password responsibly, as this can also protect you from misuse of the certificate.

The attacker would only be satisfied if the password for the stolen file was “12345,” the faster he could misuse the certificate.

With a stolen code signing certificate, the attacker can sign any file with your company name. Therefore, it is important to keep the PFX file in a safe place or request an EV code signing certificate.

The certificates of Code Signing EV They are stored in tokens and their misuse in case of theft is practically impossible: if the password is entered incorrectly several times, the token will be blocked.

What should you take into account when installing an SSL certificate on a website?

The first thing you should take into account to install an SSL certificate on a website, is that you must have three files: a file with a certificate, a private key, and a certificate chain. You now have the private key, you created it along with the CSR. You will receive the rest of the files after the certificate is issued.

The certificate file will have a .CRT extension and the certificate chain file will have a .CA-BUNDLE extension. If you open either file in a text editor, the text begins with the words “BEGIN CERTIFICATE.”

Generating a certificate in PFX format is very useful because it is the backup copy with private key of a certificate (exported from Internet Explorer).

The PFX extension is used on Windows servers for files that contain both the public key files (your SSL certificate files, provided by DigiCert) and your private key that corresponds to your certificates (generated by the server when the CSR was generated).