or drop your .pem / .crt / .key files anywhere on this page — key and certificate land in the right box automatically
Paste your certificate in the first box — pasting the whole fullchain.pem is best so the PFX carries the intermediates too.
Paste your private key in the second box; if the key itself is encrypted, enter its passphrase.
Choose a password for the .pfx — importers require one because the file contains your key.
Click "Create .pfx" and import the downloaded certificate.pfx into Windows, IIS, Azure or your Java keystore.
Windows, IIS, Azure and Java keystores want a single .pfx/.p12 file containing your certificate, its chain, and the private key — but certificate authorities hand you separate PEM files. This tool bundles them into a password-protected PFX entirely in your browser, which matters because the usual alternatives are installing OpenSSL or uploading your private key to a converter site you cannot audit.
The bundler validates as it packs: the private key must mathematically match the leaf certificate (the classic silent mistake), encrypted keys are decrypted with their passphrase on-device, and the file is packed with 3DES so every importer — including older Windows and Java versions — accepts it.
100% private“Your private key is read, validated and packed in this browser tab’s memory only — it is never uploaded, logged, or sent anywhere. You can load this page, disconnect from the network, and do the conversion fully offline.”
A PFX contains your private key, so the PKCS#12 format encrypts its contents under a password — and Windows refuses to import a password-less file. Use a strong one and share it separately from the file itself.
The modulus of the key and the certificate’s public key differ, meaning this key did not generate that certificate. Check you copied the right key file, and that the leaf (domain) certificate is the first PEM block in the certificate box.
Yes — both RSA and EC keys (P-256, P-384, P-521) are supported, including the ECDSA certificates Let’s Encrypt issues by default. Traditional (BEGIN RSA/EC PRIVATE KEY) and PKCS#8 (BEGIN PRIVATE KEY) formats are all accepted.
Yes — both are PKCS#12 archives. .pfx is the extension Microsoft tooling favors, .p12 the one Java and macOS favor; rename the file freely.