PEM vs PFX: SSL Certificate Formats and How to Install Them

After you buy or automate an SSL certificate, the next question is always which file do I upload? This guide explains PEM vs PFX (and CRT, KEY, fullchain), where each format belongs, and how to install certificates on Nginx, Apache, IIS, and hosting panels without the classic “wrong chain” outage.

PEM vs PFX SSL certificate formats

Quick Definitions

Format	What it contains	Common extensions
PEM	Base64 text blocks (`BEGIN CERTIFICATE` / `BEGIN PRIVATE KEY`)	`.pem`, `.crt`, `.key`, `.cer`
Full chain	Leaf certificate + intermediate CA certs in one PEM	`fullchain.pem`, `*-fullchain.crt`
CA bundle	Intermediate certificates only	`ca-bundle.crt`, `chain.pem`
PFX / PKCS#12	Binary bag: leaf + chain + private key, usually password-protected	`.pfx`, `.p12`

PEM is the lingua franca of Linux and most panels. PFX is what Windows IIS and many Windows tools prefer because the private key travels with the certificate in one file.

Why the Chain Matters

Browsers trust a short list of root CAs. Your leaf certificate is signed by an intermediate, which is signed by a root. If you install only the leaf, some clients (especially mobile) show trust errors.

Nginx: point ssl_certificate at fullchain
Apache: leaf in SSLCertificateFile, intermediates in SSLCertificateChainFile (or a combined file on modern Apache)
IIS: import a PFX that includes the chain

Certinite’s download ZIP separates leaf, CA bundle, fullchain, and key so you can match each server. See how to buy an SSL certificate.

Nginx Install (PEM)

ssl_certificate     /etc/ssl/example.com-fullchain.crt;
ssl_certificate_key /etc/ssl/example.com.key;

Reload Nginx after replacing files. Prefer automation so reloads happen on every renewal — Linux NGINX guide.

Apache Install (PEM)

SSLCertificateFile      /etc/ssl/example.com.crt
SSLCertificateKeyFile   /etc/ssl/example.com.key
SSLCertificateChainFile /etc/ssl/example.com-ca-bundle.crt

IIS Install (PFX)

Download PFX from your provider (or convert PEM → PFX with OpenSSL)
Import into Local Computer → Personal (or Web Hosting) store
Bind the certificate to the HTTPS site with SNI
Delete obsolete certs to avoid binding the wrong thumbprint

Windows teams often prefer an agent that imports and binds automatically — automate Let's Encrypt on IIS.

cPanel and Plesk

Panels typically paste or upload:

Certificate (CRT)
Private key
CA bundle

That is PEM workflow. If you only have a PFX, extract with OpenSSL before pasting. Panel automation options: cPanel SSL automation, Plesk SSL automation.

Converting Between Formats

With OpenSSL (examples):

# PFX → PEM pieces
openssl pkcs12 -in site.pfx -out site.pem -nodes

# PEM leaf + key + chain → PFX
openssl pkcs12 -export -out site.pfx -inkey site.key -in site.crt -certfile ca-bundle.crt

Protect PFX passwords; treat exported keys like production secrets.

Security Rules

Never commit private keys or PFX files to git
Restrict filesystem permissions (chmod 600 on keys)
Prefer platform-generated keys when you do not need to hold CSR yourself
Rotate keys if a laptop or ticket attachment may have leaked them
After install, verify with openssl s_client or SSL Labs

FAQ

Is PEM more secure than PFX?

No. Security depends on key storage and access control, not the container format.

Can I use the same certificate on Nginx and IIS?

Yes — same key pair. Export PEM for Nginx and PFX for IIS from the same material.

What if I bought SSL and only received a .crt?

You still need the private key that matched the CSR. If a vendor generated the key for you, download it from their portal; if you generated the CSR, the key is on your server.

Why does my phone show a warning but desktop Chrome does not?

Often a missing intermediate. Install the full chain / CA bundle.

Certinite Downloads

Issued manual orders provide ZIP (crt, fullchain, ca-bundle, key) plus optional PFX for Windows. Automation targets get install without you touching files. Start at certinite.com/register or compare plans on pricing.