How to Extract a Private Key From a PFX File

A PFX (or PKCS12/.p12) file bundles a certificate and its private key together in one password-protected file — sometimes you need to extract just the private key, for example when migrating to a server that expects separate PEM files rather than a combined PFX.

openssl pkcs12 -in yourcert.pfx -nocerts -out privatekey.pem -nodes

You'll be prompted for the PFX file's import password. The -nodes flag outputs the key without additional passphrase protection on the resulting file — omit it if you want the extracted key to remain passphrase-protected, though that then requires entering the passphrase every time the key is used by your server software.

Treat the extracted PEM private key file with the same care as the original PFX — delete it securely from any intermediate/temporary location once it's been moved to its final destination.

What to do if the extraction command asks for a password you don't have

If you don't know the PFX file's export password, there's no way to bypass it through standard tools — the password would need to be obtained from whoever originally created the PFX file, since PFX password protection is specifically designed to prevent extraction without it.

How to verify the extracted private key actually matches its certificate

Comparing the modulus of the extracted key against the certificate's own modulus (`openssl rsa -noout -modulus -in key.pem | openssl md5` compared against `openssl x509 -noout -modulus -in cert.pem | openssl md5`) confirms they're a notably matching pair before deploying them anywhere.

What the -nodes flag does and why omitting it changes the extracted output

The -nodes flag (no DES, meaning no encryption) tells OpenSSL to extract the private key without password-protecting the output file — omitting this flag produces an encrypted private key file requiring its own separate password to use, which most server software doesn't expect by default.

How to extract just the certificate without the private key from the same PFX file

Running openssl pkcs12 with the -clcerts and -nokeys flags extracts only the certificate portion of a PFX file, useful when you need to share or inspect the certificate itself without exposing or including the sensitive private key.

Why securely deleting the original PFX file after extraction matters for key hygiene

A PFX file contains the private key alongside the certificate, meaning it deserves the same careful handling and secure deletion as the raw key itself once you've completed extraction — leaving the original file lying around unnecessarily multiplies the number of places a sensitive key exists.

What to do if you need to extract a key from a PFX file created by unfamiliar software

PFX is a standardized format regardless of what software originally created it — OpenSSL's extraction commands work identically on any valid PFX file, meaning the specific origin software generally doesn't matter as long as the file itself is a properly formed, standard PKCS#12 file.

How to confirm the extracted key file has the correct file permissions for server use

Running chmod 600 on an extracted private key file restricts read and write access to only the file's owner, matching the restrictive permissions most server software expects and requires for private key files, and preventing other users on a shared system from reading a sensitive key.

A closing note on handling extracted keys with appropriate care

Once extracted, treat the resulting private key file with the same care as the original PFX file — restricted permissions, secure storage, and deletion once it's no longer actively needed, since the extraction process doesn't change the underlying sensitivity of what the file in fact contains.