How To: Merge Separate Certificate and Private Key Files into a PFX

Version Affected: All

 

Overview

This article explains how to combine a certificate file (.cer/.crt) and its separate private key file (.key) into a single PFX file — IIS and Windows require a certificate and its private key to be in one PFX file, but they are sometimes supplied as separate files. If a certificate is instead already installed in the Windows Certificate Store and needs to be exported (with its private key) as a PFX, see How To: Export an Installed Certificate and Its Private Key as a PFX File.

Merge a Certificate and Private Key into a PFX

1. On the IdP, place the .cer/.crt file and the .key file in the same folder, and make sure both files have the same name and only differ by extension — for example, MyCert.crt and MyCert.key.
2. Open a command prompt and run:

certutil -mergepfx MyCert.crt MyCert.pfx

3. Replace MyCert.crt with your certificate file's name, and MyCert.pfx with whatever you want the output file named. You do not need to specify the .key file — certutil derives it automatically from the certificate file's name.

If successful, the result is a PFX file that can be imported into the certificate store the normal way.

 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.