{"id":136,"date":"2017-01-19T18:35:20","date_gmt":"2017-01-19T18:35:20","guid":{"rendered":"http:\/\/www.edrockwell.com\/blog\/?p=136"},"modified":"2026-07-02T16:57:33","modified_gmt":"2026-07-02T16:57:33","slug":"certificates-convert-pfx-to-pem-and-remove-the-encryption-password-on-private-key","status":"publish","type":"post","link":"https:\/\/www.edrockwell.com\/blog\/certificates-convert-pfx-to-pem-and-remove-the-encryption-password-on-private-key\/","title":{"rendered":"Certificates – Convert pfx to PEM and remove the encryption password on private key"},"content":{"rendered":"

I’ve recently ran into a few times where we had to move a certificate from Microsoft Exchange to a HAProxy load balancer. I was provided an exported key pair that had an encrypted private key (Password Protected).<\/p>\n

We will seperate a .pfx ssl certificate to an unencrypted .key file and a .cer file<\/p>\n

The end state is to get the private key decrypted, the public cert and the certificate chain in the .pem file to make it work with openssl\/HAProxy.<\/p>\n

Requirements:
\nOpenssl installed
\n.pfx file (you need to know the password)
\nintermediate public cert (you can obatin this from your provider like Thawte)
\nroot public cert (you can obatin this from your provider like Thawte)<\/p>\n

Step 1
\nExtract the private key from the .pfx file (you need to know the password:<\/p>\n

openssl pkcs12 -in [certificate.pfx] -nocerts -out [certificate-key-encrypted.key]\r\n<\/pre>\n
Step 2
\nNow lets decrypt the key:<\/p>\n
openssl rsa -in [certificate-key-encrypted.key] -out [certificate-key-decrypted.key]<\/pre>\n
openssl rsa -in [certificate-key-encrypted.key] -out [certificate-key-decrypted.key]\r\n<\/pre>\n
Step 3
\nNow lets extract the public certificate:<\/p>\n
openssl pkcs12 -in [certificate.pfx] -clcerts -nokeys -out [certificate.crt]\r\n<\/pre>\n
Step 4
\nYou also need all the public certs in the chain up to the root. I’m talking about these:
\n\"Root<\/a><\/p>\n
Step 5
\nnow create a new text file (don’t use notepad) and put your public, private, intermediate public and root public together. It’s simple and should look like this:<\/p>\n
-----BEGIN CERTIFICATE-----\r\n### Replace with your public certificate ###\r\n### From step 3 above ###\r\n-----END CERTIFICATE-----\r\n-----BEGIN CERTIFICATE-----\r\n### replace with your intermediate public cert ###\r\n-----END CERTIFICATE-----\r\n-----BEGIN CERTIFICATE-----\r\n### replace with your root public cert ###\r\n-----END CERTIFICATE-----\r\n-----BEGIN RSA PRIVATE KEY-----\r\n### replace me with your .key file ###\r\n### from step 2 above ###\r\n-----END RSA PRIVATE KEY-----\r\n<\/pre>\n
Save the file as a .pem file.
\nIf you want to view the cert on windows, simply rename the .pem to .cer<\/p>\n
…This is how Ed does it \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"
I’ve recently ran into a few times where we had to move a certificate from Microsoft Exchange to a HAProxy load balancer. I was provided an exported key pair that had an encrypted private key (Password Protected). We will seperate a .pfx ssl certificate to an unencrypted .key file and a .cer file The end […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[67],"tags":[],"class_list":["post-136","post","type-post","status-publish","format-standard","hentry","category-certificates"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t