Free tool · Nothing is uploaded

Free SSL Converter

Different servers want certificates in different formats: Apache and Nginx use PEM files, Windows IIS and Azure import a password-protected PFX, and Java tools often want DER. This converter builds a PFX from your certificate, private key and optional CA bundle, and converts PFX, P7B, PEM and DER files. Everything runs in your browser, so your private key is never uploaded.

Create a PFX / PKCS#12 file

For Windows IIS, Exchange, Azure and other systems that import one password-protected file. Paste each part as text or choose the files you received.

Certificate

Your domain's certificate (.crt, .cer or .pem). A full-chain file works too.

Private key

The .key file created with your CSR. Password-protected keys are fine.

CA bundle (intermediate certificates)optional

Usually named ca-bundle, chain or intermediate. Include it so browsers and apps trust the certificate.

All conversions run in your browser. Your certificates and keys are never uploaded.

How it works

  1. 1

    Pick the conversion

    Create PFX, PFX → PEM, P7B → PEM, or PEM ↔ DER.

  2. 2

    Add your files

    Paste the PEM text or choose the files you received from the certificate authority. For a PFX, add the certificate, the private key from your CSR and, ideally, the CA bundle.

  3. 3

    Set a password

    A PFX is always password protected. Pick Modern (AES-256) for current systems or Legacy (3DES) for Windows Server 2016 and older.

  4. 4

    Download

    Files download straight to your device. We check that the private key matches the certificate and put the chain in the right order.

Frequently asked questions

What's the difference between PEM, DER, PFX and P7B?

PEM is Base64 text between -----BEGIN----- and -----END----- lines, used by Apache and Nginx. DER is the same data in binary. PFX (PKCS#12, .pfx or .p12) bundles the certificate, chain and private key in one password-protected file for Windows and Azure. P7B (PKCS#7) holds certificates only, never a key.

Why does it say my private key doesn't match the certificate?

Every certificate is issued for the public key in the CSR it was made from, so only that CSR's private key works with it. If you generated a new CSR, use its key, or reissue the certificate with the CSR whose key you have.

Do I need the CA bundle in my PFX?

It's strongly recommended. Without the intermediate certificates some browsers, phones and API clients can't verify your certificate, even though it is valid.

Which compatibility should I choose for a PFX?

Modern (AES-256) works with Windows Server 2019 and later, Windows 10/11, Azure and OpenSSL 3. Choose Legacy (3DES) only for Windows Server 2016 or older and old Java versions, which can't open AES-encrypted PFX files.

Is my private key uploaded?

No. The conversion code runs entirely in your browser, and the files are created on your device.

Need an SSL certificate?

DigiCert, Sectigo and RapidSSL certificates, paid in NPR with Khalti or in USD by card.

Browse certificatesMore free tools