PFX to PEM
Extract the private key and certificate chain from a .pfx / .p12 file. The file is read in this browser tab — it is never sent anywhere.
Runs locally in your browser — nothing is uploaded
Results
no key match resultPrivate key (PEM)
Certificate chain (PEM)
Bundle — key + certificates
Handy for servers that want the key and chain in one file.
Questions
Are my files or password sent anywhere?
No. The PFX file is read with the browser File API and decrypted by JavaScript running in this tab. There is no server call in this flow: open DevTools → Network and run a conversion to confirm.
Which PKCS#12 formats are supported?
Modern files (PBES2: AES-256-CBC + PBKDF2 + SHA-256 MAC) and legacy files (3DES, RC2-40, SHA-1 MAC, files without a MAC) are all supported. Passwordless files work with an empty password.
It says my file is unsupported — why?
CertKit v1 is RSA-only. Files containing EC or Ed25519 keys or certificates fail with a clear message; EC support is planned on the roadmap. Encrypted files with a wrong password fail the integrity check and report a wrong-password error.
What exactly comes out of a conversion?
The RSA private key as a PKCS#1 PEM block, every certificate in the file as PEM blocks (original order kept), and a combined bundle with the key first — ready for nginx, Apache or an environment variable.
How this runs locally
CertKit is a static site. Parsing and cryptography run inside this browser tab using a vendored copy of node-forge 1.4.0 served from this domain. Open DevTools → Network, run the tool, and you will see no request that contains your file — nothing is uploaded, and nothing is stored.