How to Convert PFX to .CRT and .KEY Files Using OpenSSL: Step-by-Step Guide

TL;DR — This 7-minute guide will help you convert your .pfx file into .crt or .key file from the encrypted key using OpenSSL Commands for free. I kept 3 minutes as a buffer 😉. Using this trick, You can —

• Convert PFX to CRT
• Convert PFX to KEY
• Extract private key from PFX
• OpenSSL commands for SSL certificates
• PFX to PEM conversion

Are you looking for extracting private key from PFX? — You are on right place.

Install OpenSSL:

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It is also a general-purpose cryptography library. For more information, you can visit the official website.

Let’s say, you have already got the .pfx certificate from the SSL providers/registrars like network solution, godaddy, bigrock etc., then you are good to follow up the below steps without any hurdles.

You need to follow up below commands in order to convert files to .crt/.key easily.

Prerequisites for Converting PFX Files

1. OpenSSL package must be installed in your system.
2. You must have .pfx file for your chosen domain name.
3. Windows/Ubuntu/Linux system to utilize the OpenSSL package with crt

Image : pfx to crt and key | Image ©️ by Author Rakshit Shah

Step 1: Extract private key from PFX

• Question: How do I extract a private key from a PFX file using OpenSSL?
• Answer: You can extract the private key from a PFX file using the following OpenSSL command:

openssl pkcs12 -in [yourfilename.pfx] -nocerts -out [keyfilename-encrypted.key]

This command will extract the private key from the .pfx file. Now we need to type the import password of the .pfx file. This password is used to protect the keypair that was created for the .pfx file. After entering the import password OpenSSL requests to type another password twice. This new password is to protect the .key file. #SafetyFirst

theraxton@ubuntu:~/Downloads/SSL-certificate$ openssl pkcs12 -in samplefilename.pfx -nocerts -out samplefilenameencrypted.key 
Enter Import Password: 
Enter PEM pass phrase: 
Verifying — Enter PEM pass phrase: 
theraxton@ubuntu:~/Downloads/SSL-certificate$

Please note that, when you are going to enter the password, you can’t see against password, but they are typing in the back. Press enter once you entered your secure password.

Step 2: Convert PFX to CRT [Extract .crt file from the .pfx certificate]

openssl pkcs12 -in [yourfilename.pfx] -clcerts -nokeys -out [certificatename.crt]

After that, press enter and give the password for your certificate, and hit enter again, after all — your certificate will appear in the same directory.

theraxton@ubuntu:~/Downloads/SSL-certificate$ openssl pkcs12 -in samplefile.pfx -clcerts -nokeys -out samplefileencrypted.crt 
Enter Import Password:

Step 3: Convert PFX to KEY [Generate .KEY File Using OpenSSL]

[Extract the .key file from the encrypted private key from step 1]

openssl rsa -in [keyfilename-encrypted.key] -out [keyfilename-decrypted.key]

We need to enter the import password which we created in step 1. Now we have a certificate(.crt) and the two private keys ( encrypted and unencrypted).

theraxton@ubuntu:~/Downloads/SSL-certificate$ openssl rsa -in samplefilenameencrypted.key -out samplefilenameunencrypted.key 
Enter pass phrase for samplefilenameencrypted.key: 
writing RSA key

Now that you have successfully converted your PFX file into .crt and .key files, you can seamlessly use them in your Node / Angular / Java applications. Have any issues? Drop a comment below!

If you find joy and value in what I do, please consider supporting my work with a donation — however much you can afford, it means and helps more than you can imagine.