> ## Documentation Index
> Fetch the complete documentation index at: https://docs.curator.interworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Converting PFX/P12 Certificates to PEM

> Convert PKCS12 (.pfx/.p12) certificates to PEM format for use with Curator on Windows.

If your certificate was provided in PKCS12 format (a `.pfx` or `.p12` file), you need to extract the PEM certificate
and private key before configuring SSL. Curator bundles OpenSSL, so you can run these commands directly in PowerShell.

1. Extract the certificate:

   ```bash theme={null}
   & 'C:\InterWorks\Curator\libs\Apache24\bin\openssl.exe' pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out [cert.pem]
   ```

2. Extract the private key:

   ```bash theme={null}
   & 'C:\InterWorks\Curator\libs\Apache24\bin\openssl.exe' pkcs12 -in [yourfile.pfx] -nocerts -nodes -out [cert.key]
   ```

3. If the `.pfx` file includes a certificate chain, extract it as well:

   ```bash theme={null}
   & 'C:\InterWorks\Curator\libs\Apache24\bin\openssl.exe' pkcs12 -in [yourfile.pfx] -cacerts -nokeys -chain -out [chain.crt]
   ```

> **Note:** If the `.pfx` / `.p12` file is password-protected, OpenSSL will prompt you for the import password when
> running these commands. The `-nodes` flag in step 2 produces an unencrypted private key, which is what Curator
> requires. If you omit `-nodes` (or are following a legacy workflow), the extracted key will be passphrase-encrypted
> — see [Removing Passphrases](/setup/ssl/windows_ssl#removing-passphrases-required-if-applicable) to remove it.