aethercert
Convert files

Convert certificates to PFX - and back

Combine an issued certificate, its chain and the private key into a .pfx for IIS or Exchange, or take a certificate or PFX apart into .cer, .crt, full chain, chain only and .key for nginx and Apache. Offline, on your computer.

Download for WindowsDocumentation

Version 1.1.2 · 27 October 2026 · Windows x64 · free · Download the aethercert Toolkit

Illustration of the aethercert Toolkit window with example data.
01Convert files

The conversions servers actually ask for

Windows wants a PFX with the chain inside; nginx and Apache want a PEM certificate, a chain file and a key; some appliances want the certificate as DER. Convert files writes each of them from the same input, and checks that the private key belongs to the certificate before it builds a PFX.

PEM input survives lost line breaks, so a certificate pasted from a web form or an e-mail still reads, and PKCS#7 (.p7b) chains are read wherever certificates are. For a certificate already in the Windows store, the certificate list exports the same formats directly.

Convert a certificate in four steps

  1. 01

    Add the input

    Certificate (.cer, .crt, .pem or .p7b), chain and private key - or an existing .pfx with its password.

  2. 02

    Choose the output

    PFX, .cer (DER), .crt/.pem, full chain, chain only and .key - several at once.

  3. 03

    Set the protection

    A PFX password, AES-256 by default or 3DES for Windows Server 2016 and older; a .key file is encrypted by default.

  4. 04

    Write the files

    Saved where you choose, ready to import into IIS or reference from nginx.

What the PFX converter handles

Key match check

A PFX is only built when the private key belongs to the certificate.

Windows Server 2016 and older

Optional 3DES encryption, because older Windows cannot read AES-256 PFX files.

Every common format

.pfx/.p12, .cer (DER), .crt and .pem (Base64), full chain, chain only and PKCS#8 .key.

PFX to PEM

Takes a PFX exported from IIS apart into certificate, chain and key for Linux servers.

Forgiving input

PEM with lost line breaks and .p7b chains are read as they are.

Scriptable

actk pfx and actk export do the same conversions in scripts.

Convert in a script

actk pfx builds a PFX, actk export takes certificates and PFX files apart; passwords are prompted for or read from an environment variable.

actk pfx --cert issued.pem --chain intermediate.pem --key www_example_com.key --out www.pfxactk pfx --cert issued.pem --key www_example_com.key --out www-2016.pfx --legacyactk export --pfx from-iis.pfx --crt www.crt --chain-out chain.pem --key-out www.keyactk export --cert issued.pem --chain intermediate.pem --cer www.cer --fullchain fullchain.pem

More tools in the Toolkit

CSR generatorCreate a CSR for any CA - server, user or code signing.Code signingCode signing CSRs and Authenticode signing with a timestamp.Certificate scannerFind every TLS certificate on your network, with expiry and issuer.TLS security scanGrade internal hosts A+ to F: protocols, ciphers, certificate, headers.Certificate managerThe Windows certificate store: import, export, renew and delete.

All Toolkit tools

Documentation

Frequently asked questions

PFX converter

How do I convert a CER to a PFX?

A .cer holds only the certificate; a PFX also needs its private key. Add the .cer, its chain and the .key from the CSR in Convert files. If the key was created in the Windows key store, import the certificate in the certificate list instead and export it as PFX from there.

How do I get the certificate and key out of a PFX for nginx?

Open the PFX in Convert files and write .crt (or full chain) and .key - or run actk export --pfx with --crt, --chain-out and --key-out.

Why does Windows Server 2016 reject my PFX?

Windows Server 2016 and older cannot read PFX files encrypted with AES-256. Build the PFX with 3DES - the option in the app, --legacy in actk.

Is my private key uploaded for the conversion?

No. The conversion runs entirely on your computer.

Converting the same certificate for every server?

aethercert installs each certificate in the format the target needs - PFX into IIS, PEM for NGINX - and renews it on schedule.

Get started free How aethercert works

Community plan, no card required. Open registration - your account is ready in a few minutes.