PEM to PFX
Build a password-protected .pfx / .p12 file from a PEM private key and one or more certificates. Everything runs in this tab — your key is never uploaded.
Runs locally in your browser — nothing is uploaded
The PFX is written by the bundled in-browser library. It uses anHMAC-SHA-1 MAC and stores certificate bags unencrypted (the private key bag is AES-256-CBC). OpenSSL and Windows read it, but if a strict platform rejects it, rebuild the file with OpenSSL. Your PEM inputs remain the authoritative copy.
Your PKCS#12 file is ready
key matches certificateDownload
The file leaves this page only through your own browser download.
Base64 of the PFX (optional)
Some platforms want the container as text. Copy it only into trusted systems.
Questions
Is the PFX this tool creates fully standard?
It is a valid PKCS#12 that OpenSSL and Windows can open and it was tested against OpenSSL, but it is built by the in-browser library, so two details differ from an OpenSSL-built file: the MAC is HMAC-SHA-1, and the certificate bags are stored unencrypted inside the container (the private key itself is AES-256-CBC encrypted). Keep your PEM files as the source of truth.
Why does it refuse a key that does not match the certificate?
A PFX whose key and certificate do not match is broken everywhere it is imported, and the failure surfaces later in confusing ways. CertKit checks the modulus and a real sign/verify round-trip first, and refuses to build a broken file.
Which password should I use?
Any non-empty password. Use a strong, unique one — the PFX will be protected by it, and the tool never sees or stores it beyond this page.
Anything I should not do with this tool?
Do not paste production private keys into a computer you do not trust — that applies to every key tool, including this one. CertKit makes no network calls, but the machine itself is your trust boundary.
How this runs locally
CertKit is a static site. Parsing and cryptography run inside this browser tab using a vendored copy of node-forge 1.4.0 served from this domain. Open DevTools → Network, run the tool, and you will see no request that contains your file — nothing is uploaded, and nothing is stored.