PFX to PEM, in your browser
Split a .pfx or .p12 into the server certificate, its private key and the chain, as PEM files a NetScaler, Apache or nginx takes: what openssl pkcs12 does, without a command line.
Your file stays on this computer. It is opened by this page, in your browser. Nothing is uploaded. The page is sent with a security policy that forbids it from making any network request at all, so it could not send your file or its key anywhere even if it tried. You can disconnect from the network before you open the file.
1. Open the file
2. Name the files and protect the key
3. Download
These names are the layout DTR Vantage's Certificate deployment reads from a share, so files made here drop straight into a renewal workflow:
What it reads, and what it writes
- Reads PFX / PKCS#12 files from Windows, IIS, OpenSSL and certificate authorities: modern AES-256 encryption and the older 3DES and RC2 forms, RSA and ECDSA keys, files with or without a password, files with no key at all.
- Puts the chain in order from the server certificate up, by issuer, whatever order the file stores it in. A certificate that is not part of that chain is named, not silently written or dropped.
- Writes
-crt.pem(the certificate),-key.pem(the key),-chain-only.pem(the intermediates, issuer first) and-chain.pem(the certificate and its intermediates). The root is left out: a server should not send it. - Protects the key with AES-256 when you give a passphrase, in the traditional OpenSSL form NetScaler and most servers read, or as PKCS#8. Without a passphrase the key file is not encrypted, and the page says so before you download it.
The PKCS#12 decoding is node-forge (BSD-3-Clause, licence), served from this site.
Renewing more than one?
DTR Vantage's certificate automation takes the renewed files from a share (or from your CA over ACME), installs them on every NetScaler that serves the certificate, links the chain and moves every binding, with a preview first and a report after.