OpenSSL on Windows Made Simple: Create a PFX Certificate from PEM Files

Introduction

When you work with SSL/TLS certificates on Windows—especially for platforms like Azure Key Vault, IIS, Application Gateway, Load Balancers, or Kubernetes—you’ll often receive certificates in PEM format (for example: .pem, .crt, fullchain.pem).

The challenge: many enterprise platforms require a PFX (PKCS#12) file for import because it bundles:

  • The certificate
  • The private key
  • The certificate chain (intermediate CA certificates)

On Windows, OpenSSL isn’t installed by default, so you might see this error:

openssl : The term 'openssl' is not recognized as the name of a cmdlet...

This guide explains how to install OpenSSL on Windows and use it to convert PEM files into a PFX—reliably and safely.

Why OpenSSL on Windows?

OpenSSL is the most widely used tool for certificate operations such as:

  • Converting between formats (PEM ↔ PFX ↔ DER)
  • Bundling certificate + private key + intermediates into one file
  • Validating that a private key matches a certificate
  • Inspecting certificate details (issuer, expiry, SANs, etc.)

Method 1: Install OpenSSL on Windows using Winget (Recommended)

Step 1: Open PowerShell as Administrator

  1. Click Start
  2. Search PowerShell
  3. Right-click and choose Run as Administrator

Step 2: Install OpenSSL

Run the following command:

winget install -e --id ShiningLight.OpenSSL.Light

Step 3: Restart PowerShell and confirm installation

Close PowerShell, reopen it, then run:

openssl version

If you see a version output (for example OpenSSL 3.x.x), installation is successful.

Fix: OpenSSL Installed but Still “Not Recognized”

Sometimes OpenSSL installs correctly but isn’t added to your system PATH automatically.

Step 1: Check the common install directory

Most commonly OpenSSL is installed here:

  • C:\Program Files\OpenSSL-Win64\bin

Step 2: Add OpenSSL to PATH temporarily (current session)

This works immediately for the current PowerShell window:

$env:Path += ";C:\Program Files\OpenSSL-Win64\bin"
openssl version

Step 3: Add OpenSSL to PATH permanently (recommended)

  1. Open Start → search Environment Variables
  2. Click Edit the system environment variables
  3. Click Environment Variables
  4. Under System variables, select Path → click Edit
  5. Click New → add: C:\Program Files\OpenSSL-Win64\bin
  6. Click OK on all windows
  7. Close and reopen PowerShell
  8. Run:
openssl version

Convert PEM to PFX (Certificate + Private Key + Chain)

What files do you need?

Typically you will have 2–3 files:

  • privkey.pem → private key
  • cert.pem → leaf certificate (your domain certificate)
  • chain.pem → intermediate certificates (CA chain)

Important: A certificate without a private key cannot be imported as a PFX for most platforms.

Step 1: Move your files to a working folder

Example folder:

  • C:\tmp

Ensure your files are in C:\tmp, then run:

cd C:\tmp

Step 2: Create a PFX using OpenSSL

Run:

openssl pkcs12 -export `
  -out cert-import.pfx `
  -inkey privkey.pem `
  -in cert.pem `
  -certfile chain.pem

You will be prompted to enter an export password.
Save this password securely—you will need it to import the PFX.

✅ Output file: C:\tmp\cert-import.pfx

Validate the Certificate and Private Key Match (Highly Recommended)

This avoids importing the wrong key/certificate pair.

If your private key is RSA

Run:

openssl rsa -in privkey.pem -noout -modulus | openssl md5
openssl x509 -in cert.pem -noout -modulus | openssl md5

✅ The hash values must match.

If your private key is EC (Elliptic Curve)

Run:

openssl pkey -in privkey.pem -pubout | openssl sha256
openssl x509 -in cert.pem -pubkey -noout | openssl sha256

✅ The hash values must match.

Common Errors and How to Fix Them

Error: “Private key is not specified…”

This means you tried to import a PEM that contains only certificates but no private key.

Fix:

  • Locate the private key from the server/system where the CSR was generated, or
  • Re-generate a new CSR and request the certificate again

Error: “unable to load private key”

Common causes:

  • Wrong file path
  • Key file is encrypted and needs a passphrase
  • Invalid key format

Fix:
Open the private key file and confirm it contains one of these headers:

  • -----BEGIN PRIVATE KEY-----
  • -----BEGIN RSA PRIVATE KEY-----
  • -----BEGIN ENCRYPTED PRIVATE KEY-----

Security Best Practices (Do This)

Private keys are sensitive. Treat them like passwords.

  • Store .pem and .pfx files securely
  • Never email private keys or upload them to untrusted platforms
  • Remove temporary working files after import (if not needed)
  • Use least-privilege access for certificate operations

Summary

By installing OpenSSL on Windows, you can quickly convert PEM files into a PFX bundle suitable for enterprise imports.

What you achieved:

  • Installed OpenSSL on Windows
  • Fixed PATH issues (if needed)
  • Created a PFX from PEM files
  • Validated your cert and key match