How to create .pfx file from certificate and private key?

Question

I need .pfx file to install https on website on IIS.

I have two separate files: certificate (.cer or pem) and private key (.crt) but IIS accepts only .pfx files.

I obviously installed certificate and it is available in certificate manager (mmc) but when I select Certificate Export Wizard I cannot select PFX format (it's greyed out)

Are there any tools to do that or C# examples of doing that programtically?

possible duplicate of [Convert a CERT/PEM certificate to a PFX certificate](http://stackoverflow.com/questions/808669/convert-a-cert-pem-certificate-to-a-pfx-certificate) — Daniel DiPaolo, Jun 10 '11 at 14:40
true, but its answer is not clear and doesn't fix anything in my case — jlp, Jun 10 '11 at 15:02
Openssl is entirely unnecessary in nearly all cases. Just added my answer (which I create a blog entry to provide). The irony is that when you generate the CSR as intended, you likely won't even need the PFX. — rainabba, Mar 08 '14 at 00:23
had to install a PFX file on a windows IIS today, and had the same issue of generating one and ended up on your question. what i ended up doing, if anyone else needs a easy option... i bought an ssl from these guys: https://www.ssltrust.com.au/geotrust and when you collect the certificate, they actually have an in-build PFX file generator, so you can build and download it to install right away. — PixelPaul, May 27 '21 at 08:00

jdehlin · Answer 1 · 2022-01-19T02:06:08.133

920

You will need to use openssl.

openssl pkcs12 -export -out domain.name.pfx -inkey domain.name.key -in domain.name.crt

The key file is just a text file with your private key in it.

If you have a root CA and intermediate certs, then include them as well using multiple -in params

openssl pkcs12 -export -out domain.name.pfx -inkey domain.name.key -in domain.name.crt -in intermediate.crt -in rootca.crt

If you have a bundled crt file that you use, for example, with nginx, you can pass that in along with the cert all in one:

cat domain.name.crt | tee -a domain.name.bundled.crt
cat intermediate.crt | tee -a domain.name.bundled.crt
cat rootca.crt | tee -a domain.name.bundled.crt
openssl pkcs12 -export -out domain.name.pfx \
  -inkey domain.name.key \
  -in domain.name.bundled.crt

You can install openssl from here: openssl

edited Jan 19 '22 at 02:06

answered Jun 24 '13 at 20:20

jdehlin

10,909
3
22
33

21

"The key file is just a text file with your private key in it." True, except when it isn't. – Casey Apr 30 '14 at 04:34
Thanks, this helped me a lot. I had to login to a Ubuntu server for this to actually work, but I was able to do it there and then SCP the file down. I also needed to use a combined certificate (my certificate is chained) but I had already concatenated the appropriate files to work with Nginx, on tht server so I just used that. Really helpful! – Julia McGuigan Jun 05 '14 at 13:32
54

Thanks, I'll also add if you have a root CA or intermiediate cert you can append it by supplying multiple **-in** parameter: `openssl pkcs12 -export -out domain.name.pfx -inkey domain.name.key -in domain.name.crt -in intermediate.crt -in rootca.crt` – gerrytan Jan 27 '15 at 23:33
17

Did the job for me. As a minor note, running this on a Windows machine requires you to run openssl in an Administrator command prompt. – Martin Costello Feb 08 '15 at 14:38
20

Where do you get the key file from? I got an SSL cert issued, but I don't see a keyfile anywhere. Just got a p7b file and a bunch of *.crt files. – Knelis Apr 16 '15 at 10:02
1

There's a comprehensive blog on this process here: http://elgwhoppo.com/2013/04/18/combine-crt-and-key-files-into-a-pfx-with-openssl/ – JohnLBevan Aug 27 '15 at 08:24
3

@gerrytan, For combining intermediate certs I had to use `-certfile` option. – Santosh Feb 17 '16 at 04:46
2

Add `-name friendly.domain.name` to specify the "friendly name" used by IIS. – murraybiscuit Apr 10 '16 at 19:58
1

Where I get the .key file? I generate the CSR with DigiCertUtil.exe, and I get .crt and .p7b files from GoDaddy... – Gabrielizalo Aug 21 '16 at 10:31
I fixed it with the portable certificate converter from DigiCert: https://www.digicert.com/util/pfx-certificate-management-utility-import-export-instructions.htm – Gabrielizalo Aug 21 '16 at 10:39
8

For reference, on windows, you might need to prepend "winpty" in front of the whole line: https://stackoverflow.com/a/38202633/413785 – tkit Aug 02 '17 at 12:56
@jdehlin, I have created the Pfx file from the xxx.cert.pem file and private key file But when I call the method - sslStream.AuthenticateAsClient(hostName, certificates, SslProtocols.Default, true); then I am getting error like below " The remote certificate is invalid according to the validation procedure.". Please advise. – SaddamBinSyed Sep 07 '17 at 08:35
9

Openssl is also included in the "Git for Windows" shell. – BaluJr. Sep 10 '17 at 16:44
Why do I need to include intermediate and root CA in the .pfx? – Eduardo Arruda Pimentel Dec 22 '17 at 20:38
42

In order to get this to work on openssl 1.0.2m I had to specify `-certfile intermediate.crt -certfile rootca.crt` before I was prompted to protect the `.pfx` with a passphrase/password. I believe this is possibly because the `.key` didn't match the additional `-in` files resulting in the "No certificate matches private key" error message I was getting. – dragon788 Mar 22 '18 at 02:56
to include intermediate,root cert files openssl pkcs12 -export -out domain.name.pfx -inkey domain.name.key -in domain.name.crt -certfile intermediate.crt -certfile caroot.crt – Apuri Srikanth Mar 15 '19 at 20:01
It worked for me too but when i tried to provide intermediate certificates it gave me an error. We forgot/lost the Private key. We exported old certificate and created a key from that and then converted a new cer certificate to pfx but without adding -in for intermediate. The error we received was : Openssl error “No certificate matches private key” when creating .PFX – khalidmehmoodawan Apr 15 '19 at 13:42
6

I installed openssl from the link above, but couldn't find openssl executable. However, base on BaluJr. I was able to run openssl from "Git Bash Here" except that I have to add "winpty" in front (thanks to pootzko). In the end, I was able to generate the pfx file using sslforfree's certificate using `winpty openssl pkcs12 -export -out "certificate_combined.pfx" -inkey "private.key" -in "certificate.crt" -certfile ca_bundle.crt` – newman Jun 12 '19 at 03:12
It worked for me the url of each file should be between two " – Kemal AL GAZZAH May 18 '20 at 12:40
1

This command hangs for me on Windows with Git Bash. Even run git bash as administrator. Strange. – Rhyous Sep 23 '20 at 14:52
1

Oh. I see the winpty comment and understand it now. With that, it didn't hang. :-) – Rhyous Sep 23 '20 at 14:55
1

This command hangs for me on Windows with Git Bash too. I think it tries to prompt for a password using an application that's missing on my machine. Executing from CMD C:\Program Files\Git\usr\bin\openssl.exe seems to work. – Petre Lukarov Mar 29 '21 at 22:05
shouldn't this be the accepted answer? – Jack0fshad0ws Oct 28 '21 at 20:54
God bless you brother... you saved a lot of my time. TKS – Blasco73 Jan 28 '22 at 10:43
1

Azure will not accept a certificate unless it is encrypted with DES resulting in the error message "The password is incorrect, or the certificate is not valid." By default, the latest version of OpenSSL now defaults to AES-256-CBC encryption. Adding the parameters ```-certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES``` will correct this problem. You may also want include your CA's intermediate certificates with the ```-certfile``` parameter (i.e. ```-certfile DigiCertCA.crt```) – Terence Golla May 27 '22 at 03:16
1

@TerenceGolla+ specifically OpenSSL since 3.0.0 last year uses PBES2 and AES, which much(?) MSware doesn't like. More simply, you can use `-legacy` to get the traditional RC2-40 for cert(s) and 3DES for key(s), or `-legacy -descert` to get 3DES for both. – dave_thompson_085 Jul 16 '22 at 07:04

score 50 · Answer 2 · answered Aug 14 '14 at 23:11

50

If you're looking for a Windows GUI, check out DigiCert. I just used this and it was fairly simple.

Under the SSL tab, I first Imported the Certificate. Then once I selected the Certificate I was able to export as a PFX, both with and without a keyfile.

https://www.digicert.com/util

answered Aug 14 '14 at 23:11

joelnet

13,621
5
35
49

19

When I do this, it tells me I do not have the private key imported on my computer. Which is true. – Niels Brinch Nov 22 '17 at 13:29
8

@NielsBrinch When I do this, it also tells me I do not have the private key imported on my computer. Expect that it's false, it's in the same folder as the certificate... – aBertrand Apr 26 '18 at 06:31
1

@NielsBrinch To resolve this issue, I had to re-submit a new CSR and then download the cert again when it was processed, the private key was hidden on the server/machine you created the CSR on. This solved that error message. – Paddymac May 31 '19 at 09:19
I can recommend DigiCert based on several years of experience with them. – mmell Feb 10 '20 at 20:14
1

Don't forget to include the private key in the root directory of the `DigiCertUtil.exe` executable. Easiest is to just copy it to the certificate folder. – Jonas Apr 23 '20 at 03:54
Warning : the certificate must be installed in Computer Certificate Store (Digicert can propose to you to "repair" the certificate if it is not installed in the correct location) – rdhainaut Aug 21 '20 at 21:50

Seymour · Answer 3 · 2014-10-29T16:09:14.763

41

The Microsoft Pvk2Pfx command line utility seems to have the functionality you need:

Pvk2Pfx (Pvk2Pfx.exe) is a command-line tool copies public key and private key information contained in .spc, .cer, and .pvk files to a Personal Information Exchange (.pfx) file.
http://msdn.microsoft.com/en-us/library/windows/hardware/ff550672(v=vs.85).aspx

Note: if you need/want/prefer a C# solution, then you may want to consider using the http://www.bouncycastle.org/ api.

edited Oct 29 '14 at 16:09

answered Sep 09 '13 at 18:03

Seymour

7,043
12
44
51

1

-spc argument for the .cer file – BozoJoe Feb 23 '16 at 06:21
3

C:\Program Files (x86)\Windows Kits\10\bin\10.0.15063.0\x64\pvk2pfx.exe – Stefan Steiger Sep 21 '18 at 06:56
This Pvk2Pfx.exe tool may not run in 'normal' PowerShell, but if you have VisualStudio installed you can run it from the Developer PowerShell: VisualStudio => Tools => Command Line => Developer PowerShell – TechAust10 May 06 '22 at 20:04

score 41 · Answer 4 · edited Dec 06 '22 at 09:38

41

Solution for Windows that doesn't require OpenSSL installed

I recently was trying to solve the same issue - and I only had a windows laptop with no openssl installed (and no enough admin rights to install it). Turns out windows has built-in utility called certutil that is capable of combining .crt and .key files into .pfx. Docs are here.

You need to create a new folder and place you .crt and key files in it. Rename both files to have the same name (but different extension):

{{sitename}}.crt
{{siteName}}.key

In case your key file is a regular txt - just change extension to .key.

After that open cmd in that folder and run certutil -mergepfx [INPUTFILE] [OUTPUTFILE]

Example:

certificate file: mySite.crt

key file: mySite.key

certutil command: certutil -mergepfx mySite.crt mySite.pfx

Note: you will be asked to provide password for newly created .pfx file - don't forget to memorise/store it - as it will be required during certificate import on the target system.

edited Dec 06 '22 at 09:38

Rory

40,559
52
175
261

answered Jun 12 '22 at 11:41

Yura

2,013
19
25

1

Thanks this was exactly what I was looking for. It was tricky that the .key file needed the same name in the same folder to work. – slingshot Nov 15 '22 at 07:11
3

This is great. For anyone else like me that can't read, if you get error `80 ERROR_FILE_EXISTS` it's because you've typed the key file name instead of `mysite.pfx` ;) Just re-read the instructions above closely. – Rory Dec 06 '22 at 09:36
Many thanks! Direct to the point, it saved my day! :-) – André Miranda Feb 01 '23 at 17:06

score 34 · Answer 5 · edited Jun 19 '22 at 09:47

34

You do NOT need openssl or makecert or any of that. You also don't need the personal key given to you by your CA. I can almost guarantee that the problem is that you expect to be able to use the key and cer files provided by your CA but they aren't based on "the IIS way".

SSL Certs for IIS with PFX once and for all - SSL and IIS Explained - http://rainabba.blogspot.com/2014/03/ssl-certs-for-iis-with-pfx-once-and-for.html

Use IIS "Server Certificates" UI to "Generate Certificate Request" (the details of this request are out of the scope of this article but those details are critical). This will give you a CSR prepped for IIS. You then give that CSR to your CA and ask for a certificate. Then you take the CER/CRT file they give you, go back to IIS, "Complete Certificate Request" in the same place you generated the request. It may ask for a .CER and you might have a .CRT. They are the same thing. Just change the extension or use the . extension drop-down to select your .CRT. Now provide a proper "friendly name" (*.yourdomain.example, yourdomain.example, foo.yourdomain.example, etc..) THIS IS IMPORTANT! This MUST match what you setup the CSR for and what your CA provided you. If you asked for a wildcard, your CA must have approved and generated a wildcard and you must use the same. If your CSR was generated for foo.yourdomain.example, you MUST provide the same at this step.

edited Jun 19 '22 at 09:47

Stephen Ostermiller

23,933
14
88
109

answered Mar 08 '14 at 00:22

rainabba

3,804
35
35

PFX's aren't just for IIS though, can be used for code signing. Unless I'm mistaken, signtool.exe and signcode.exe only accept a .pfx – EionRobb Mar 16 '14 at 23:50
6

The question opened with: "I need .pfx file to install https on website on IIS." – rainabba Mar 18 '14 at 06:20
38

Can you please put relevant content of your post in your answer please? That way, the answer is still relevant even if your blog disappears. You can still link to your blog. As it is, there is 0 useful information in the content of the answer. – Deanna Sep 24 '14 at 08:43
21

This is the simplest way if you're requesting a new certificate, however it won't work if you already have a certificate and/or private key (e.g. one you previously used with apache) because IIS's certificate signing request will generate a new private key.I find this aspect of IIS really annoying since all the "complete request" is doing is combining the private key with the public certificate to produce a pfx, why it couldn't just accept them as separate PEM formatted files who knows. – Chris Chilvers May 21 '15 at 15:41
2

While I appreciate that your solution is most likely "the right way to do" things, I think it's more effort than meddling around with openssl - one tool, one commandline call, one password, done. Also I don't know if all ssl companies support this approach. – Jan Bühler Aug 06 '15 at 09:02
@Deanna I've edited the post to include the part that I found most helpful. If other content would be needed please let me (or someone) know. Thanks! – jocull Dec 05 '16 at 14:14
11

I'm afraid your answer doesn't help if the certificate was generated elsewhere. Okay, IIS expects to generate and hang on to the private key itself - sometimes that's just not an option. – staticsan Mar 15 '17 at 05:01
2

Your answer and blog and quite misleading, and incorrect. You can use the private key and certificate generated by a CA to install a certificate in IIS. I never use the builtin IIS CSR generation feature, as it requires the certificate to be installed on the same server used to create the CSR, which is often not feasible. You can use openssl to generate all required files, and not do things the "IIS way" and still import the certificate into IIS. – user1751825 May 18 '18 at 04:07
1

I like to hug you but, as of aug 2020, the Chrome browser requires certificates with SAN (subject alternative names), which IIS-generated CSR does not provide.You will not be able to surf your site with Chrome. So your fast recipe does not work any more. Too bad, IIS is just not up to date. But you can use the Microsoft certificates tool under MMC, which supports SAN, and which is probably just a litte bit simpler to use than using OpenSSL because it is GUI based, and manages (=hides) your private key. – Roland Aug 20 '20 at 09:08
This is not an answer to the question posed, which is the question I need the answer to right now. You're answering a different, related question. – reinierpost Aug 09 '22 at 11:45

score 19 · Answer 6 · answered Jan 08 '17 at 10:55

19

I created .pfx file from .key and .pem files.

Like this openssl pkcs12 -inkey rootCA.key -in rootCA.pem -export -out rootCA.pfx

answered Jan 08 '17 at 10:55

Siim Nelis

882
7
10

5

This is basically the same command I used, but I needed to add winpty before openssl (eg, winpty openssl pkcs12....) while using Git bash, which is a common solution for openssl on windows. – smoore4 Feb 09 '17 at 00:38
I did not need the `-export` switch. – mmell Feb 13 '20 at 20:35

score 12 · Answer 7 · edited Jan 16 '20 at 16:41

https://msdn.microsoft.com/en-us/library/ff699202.aspx

(( relevant quotes from the article are below ))

Next, you have to create the .pfx file that you will use to sign your deployments. Open a Command Prompt window, and type the following command:
PVK2PFX –pvk yourprivatekeyfile.pvk –spc yourcertfile.cer –pfx yourpfxfile.pfx –po yourpfxpassword
where:

pvk - yourprivatekeyfile.pvk is the private key file that you created in step 4.

spc - yourcertfile.cer is the certificate file you created in step 4.

pfx - yourpfxfile.pfx is the name of the .pfx file that will be creating.

po - yourpfxpassword is the password that you want to assign to the .pfx file. You will be prompted for this password when you add the .pfx file to a project in Visual Studio for the first time.

(Optionally (and not for the OP, but for future readers), you can create the .cer and .pvk file from scratch) (you would do this BEFORE the above). Note the mm/dd/yyyy are placeholders for start and end dates. see msdn article for full documentation.

makecert -sv yourprivatekeyfile.pvk -n "CN=My Certificate Name" yourcertfile.cer -b mm/dd/yyyy -e mm/dd/yyyy -r

score 12 · Answer 8 · answered Sep 16 '21 at 19:59

From this links:

If you need, use this simple command sequence with OpenSSL to generate filessl.key (SSL certificate key file), and filessl.crt (SSL certificate file):

openssl genrsa 2048 > filessl.key
chmod 400 filessl.key
openssl req -new -x509 -nodes -sha256 -days 365 -key filessl.key -out filessl.crt

Until here you must respond to the interactive form (you can find reference info like req.cnf from this other post: https://stackoverflow.com/a/49784278/7856894)

Then, continue with this last command, which will ask you type the Export Password:

openssl pkcs12 -export -out filessl.pfx -inkey filessl.key -in filessl.crt

Ready, it generated your SSL certificate file in .PFX (or .P12) format: filessl.pfx.

by far the most useful stuff – Simon Giesen Mar 03 '23 at 13:42 — Simon Giesen, Mar 03 '23 at 13:42

score 9 · Answer 9 · edited Sep 22 '15 at 16:13

9

You need to use the makecert tool.

Open a command prompt as admin and type the following:

makecert -sky exchange -r -n "CN=<CertificateName>" -pe -a sha1 -len 2048 -ss My "<CertificateName>.cer"

Where <CertifcateName> = the name of your cert to create.

Then you can open the Certificate Manager snap-in for the management console by typing certmgr.msc in the Start menu, click personal > certificates > and your cert should be available.

Here is an article.

https://azure.microsoft.com/documentation/articles/cloud-services-certs-create/

edited Sep 22 '15 at 16:13

Thraka

2,065
19
24

answered Jun 10 '11 at 14:41

BentOnCoding

27,307
14
64
92

3

I can't. In export wizard pfx option is grayed out – jlp Jun 10 '11 at 15:00
my cert is available in certifacate manager. What I cannot do is to export if to pfx format. What does your command line instruction do? – jlp Jun 10 '11 at 15:39
Try creating the cert as advised and let me know if it works. It'll probably take 5 minutes. The article linked gives a full explanation of whats going on. – BentOnCoding Jun 10 '11 at 16:13
It's not what i'm looking for. I don't want to make cert. myself. I bought cert from cert authority in 2 files. I'd rather use OpenSSL tool – jlp Jun 13 '11 at 12:28

score 8 · Answer 10 · answered Mar 09 '15 at 13:21

8

This is BY FAR the easiest way to convert *.cer to *.pfx files:

Just download the portable certificate converter from DigiCert: https://www.digicert.com/util/pfx-certificate-management-utility-import-export-instructions.htm

Execute it, select a file and get your *.pfx!!

answered Mar 09 '15 at 13:21

user1613797

1,197
3
18
33

3

Probably worth mentioning that you first need to "install" the certificate, and then get back to the SSL tab and "export" it to obtain the actual pfx file. – access_granted Sep 28 '17 at 00:58

score 5 · Answer 11 · edited May 23 '17 at 11:54

I got a link with your requirement.Combine CRT and KEY Files into a PFX with OpenSSL

Extracts from the above link:

First we need to extract the root CA certificate from the existing .crt file, because we need this later. So open up the .crt and click on the Certification Path tab.

Click the topmost certificate (In this case VeriSign) and hit View Certificate. Select the Details tab and hit Copy to File…

Select Base-64 encoded X.509 (.CER) certificate Save it as rootca.cer or something similar. Place it in the same folder as the other files.

Rename it from rootca.cer to rootca.crt Now we should have 3 files in our folder from which we can create a PFX file.

Here is where we need OpenSSL. We can either download and install it on Windows, or simply open terminal on OSX.

EDIT:

There is a support link with step by step information on how to do install the certificate.
After successfully install, export the certificate, choose .pfx format, include private key.

Important Note: : To export the certificate in .pfx format you need to follow the steps on the same machine from which you have requested the certificate.
The imported file can be uploaded to server.

Can you please explain? how exactly you created the PFX file from CERT file? Where or how did you made the KEY file please all are confusing. — , Jun 25 '14 at 07:15
Can you kindly explaine from here how they KEY file you got? e.g: `openssl pkcs12 -inkey example.com.key -in example.com.crt -export -out example.com.pfx` — , Jun 25 '14 at 07:15

score 5 · Answer 12 · answered Jan 09 '22 at 17:42

I was trying openssl on macbook with libreSSL v2.8.3 and was getting error "No certificate matches private key". I had one domain cert, 2 intermediates and 1 root cert. So I used following command which worked successfully:

openssl pkcs12 -export -clcerts -inkey private.csr.key -in domain.name.crt -certfile intermediate1.crt -certfile intermediate2.crt -certfile root.crt -out domain.name.p12 -name "Your Name"

It will ask for a password that will be used during import. This command will generate a .p12 file which can be renamed to .pfx as both are same.

score 4 · Answer 13 · answered Feb 26 '13 at 18:53

When you say the certificate is available in MMC, is it available under "Current User" or "Local Computer"? I've found that I can only export the private key if it is under Local Computer.

You can add the snap in for Certificates to MMC and choose which account it should manage certificates for. Choose Local Computer. If your certificate is not there, import it by right clicking the store and choosing All Tasks > Import.

Now navigate to your imported certificate under the Local Computer version of the certificate snap in. Right click the certificate and choose All Tasks > Export. The second page of the export wizard should ask if you want to export the private key. Select Yes. The PFX option will now be the only one available (it is grayed out if you select no and the option to export the private key isn't available under the Current User account).

You'll be asked to set a password for the PFX file and then to set the certificate name.

score 4 · Answer 14 · answered Feb 24 '23 at 13:16

4

openssl pkcs12 -export -in certificate.cer -inkey privateKey.key -out certificate.pfx

answered Feb 24 '23 at 13:16

Appesh

374
4
6

1

I have replaced `certificate.cer` with `certificate.crt` and it worked for me. – Gucu112 Jun 07 '23 at 10:03

score 2 · Answer 15 · answered Jun 28 '16 at 15:55

I was having the same issue. My problem was that the computer that generated the initial certificate request had crashed before the extended ssl validation process was completed. I needed to generate a new private key and then import the updated certificate from the certificate provider. If the private key doesn't exist on your computer then you can't export the certificate as pfx. They option is greyed out.

score 2 · Answer 16 · answered Oct 08 '21 at 10:28

I would like to promote the "X certificate and key manager" or xca.exe, it's like a GUI version of OpenSSL. With that you can generate the pfx file by the following steps:

Import private key in the "Private Keys" tab;
Import the certificate in the "Certificates" tab;
Generate the pfx file by selecting the certificate and then "Export", select PKCS #12 as the format.

That's it.

score 1 · Answer 17 · answered Mar 06 '16 at 22:21

1

In most of the cases, if you are unable to export the certificate as a PFX (including the private key) is because MMC/IIS cannot find/don't have access to the private key (used to generate the CSR). These are the steps I followed to fix this issue:

Run MMC as Admin
- Generate the CSR using MMC. Follow this instructions to make the certificate exportable.
Once you get the certificate from the CA (crt + p7b), import them (Personal\Certificates, and Intermediate Certification Authority\Certificates)
IMPORTANT: Right-click your new certificate (Personal\Certificates) All Tasks..Manage Private Key, and assign permissions to your account or Everyone (risky!). You can go back to previous permissions once you have finished.
Now, right-click the certificate and select All Tasks..Export, and you should be able to export the certificate including the private key as a PFX file, and you can upload it to Azure!

Hope this helps!

answered Mar 06 '16 at 22:21

Jose Parra

877
9
23

I already have my certificadte in Personal\Certificates, but with Right Click dont appears "Manage Private Key". The options I get are: "Request Certificate with New key...", "Renew Certificate with New key..." and "Export"... Do you have any idea what I'm missing? – Gabrielizalo Aug 21 '16 at 10:27
2

I fixed it with the portable certificate converter from DigiCert: https://www.digicert.com/util/pfx-certificate-management-utility-import-export-instructions.htm – Gabrielizalo Aug 21 '16 at 10:39
You failed at "generate CSR". If you already have the private key, you don't need to generate a CSR. Please read the original question. – NickG Feb 26 '17 at 10:08

score 0 · Answer 18 · answered Sep 05 '22 at 09:49

I've written a small console app which converts a PEM certificate file and a private key file to one .pfx PKCS12 certificate file. It uses BouncyCastle library.

My Github repo: https://github.com/nklkli/PEM-to-PKCS12

Feel free to modify the code to create password protected *.pfx.

How to create .pfx file from certificate and private key?

18 Answers18

Linked