> For the complete documentation index, see [llms.txt](https://clients.medianova.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://clients.medianova.com/products/security/ssl-tls-encryption/extract-crt-and-key-files-from-a-pfx-certificate.md).

# Extract CRT and KEY Files from a PFX Certificate

A PKCS#12 (`.pfx`) file contains a certificate, private key, and optional intermediate certificates in a single encrypted bundle. Although the **SSL / TLS** wizard supports uploading `.pfx` files directly, some environments or workflows require separate `.crt` and `.key` files.

This guide explains how to extract the certificate and private key from a PKCS#12 file using OpenSSL.

{% hint style="info" %}
This procedure is optional. If your certificate is already available as a PKCS#12 (`.pfx`) file, you can upload it directly using the **Upload PKCS#12 (.pfx)** option in the **SSL / TLS** wizard.
{% endhint %}

## Prerequisites

Before you begin, ensure that you have:

* A valid PKCS#12 (`.pfx`) certificate file.
* The password protecting the `.pfx` file.
* OpenSSL installed on your system.
* (Optional) A descriptive filename such as `example_com.pfx`.

{% stepper %}
{% step %}

### Create the Extraction Script

Create a new Bash script named **extract-cert.sh** and paste the following content.

```bash
#!/bin/bash
# Usage: ./extract-cert.sh <pfx-password>

# 1. Extract encrypted private key
openssl pkcs12 -in domain.pfx -nocerts -out encrypted-domain.key -passin pass:$1 -passout pass:$1

# 2. Decrypt the private key
openssl rsa -in encrypted-domain.key -out domain.key -passin pass:$1

# 3. Extract public certificate
openssl pkcs12 -in domain.pfx -clcerts -nokeys -out domain.crt -passin pass:$1

# 4. Verify that the certificate and key match
first=$(openssl x509 -in domain.crt -modulus -noout | openssl md5)
second=$(openssl rsa -in domain.key -modulus -noout | openssl md5)

if [[ "$first" == "$second" ]]; then
    echo "✅ Certificate and Key match."
else
    echo "❌ Mismatch between certificate and key."
fi
```

Save the file after replacing `domain.pfx` with your actual filename.

{% hint style="info" %}
For example, if your certificate file is named `medianova_com.pfx`, update the script accordingly before running it.
{% endhint %}
{% endstep %}

{% step %}

### Make the Script Executable

Grant execute permission to the script.

```bash
chmod +x extract-cert.sh
```

This command allows the script to be executed from the command line.
{% endstep %}

{% step %}

### Run the Script

Run the script and provide the password for your PKCS#12 file.

```bash
./extract-cert.sh yourPFXpassword
```

Replace `yourPFXpassword` with the actual password for the `.pfx` file.

The script extracts the certificate and private key, then verifies that they belong to the same certificate pair.
{% endstep %}

{% step %}

### Review the Generated Files

After the script finishes successfully, the following files are created.

| File                   | Description                                                                   |
| ---------------------- | ----------------------------------------------------------------------------- |
| `domain.crt`           | Public certificate.                                                           |
| `domain.key`           | Unencrypted private key.                                                      |
| `encrypted-domain.key` | Temporary encrypted private key. This file can be deleted after verification. |
| {% endstep %}          |                                                                               |

{% step %}

### Verify the Results

If the extraction succeeds, the script prints:

```
✅ Certificate and Key match.
```

If the certificate and private key do not belong to the same certificate:

```
❌ Mismatch between certificate and key.
```

{% hint style="info" %}
If a mismatch is reported, verify that you are using the correct `.pfx` file and password before repeating the extraction process.
{% endhint %}
{% endstep %}
{% endstepper %}

## Next Steps

After extracting the files, you can use either of the following options in the **SSL / TLS** wizard:

* **Upload Certificate Files** to upload the generated `.crt` and `.key` files.
* **Paste Certificate and Private Key** to paste their contents directly into the wizard.

If you do not need separate certificate files, upload the original `.pfx` file directly using the **Upload PKCS#12 (.pfx)** option.

### Related Concepts

* [Upload and Manage SSL Certificates](/products/security/ssl-tls-encryption/upload-and-manage-ssl-certificates.md)
* [SSL / TLS Encryption](/products/security/ssl-tls-encryption.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://clients.medianova.com/products/security/ssl-tls-encryption/extract-crt-and-key-files-from-a-pfx-certificate.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.