Apps Artificial Intelligence CSS DevOps Go JavaScript Laravel Linux MongoDB MySQL PHP Python Rust Svelte Vue

Creating a CA Bundle and Converting an SSL Certificate to .PFX

1 min read .
Published on
Creating a CA Bundle and Converting an SSL Certificate to .PFX

Managing SSL/TLS certificates is a routine task for many developers and system administrators. One common requirement is to combine intermediate certificates into a CA bundle and then convert the certificate and private key into a .pfx file.

The .pfx format, also known as PKCS#12, is commonly used when importing certificates into Windows Server and IIS, Microsoft Exchange, and other applications that expect a PKCS#12 bundle.

This guide walks through the process.

1. Create a CA Bundle

A certificate provider may give you several files:

  • The domain certificate, such as STAR_aaa_net.crt
  • One or more intermediate CA certificates
  • A root certificate, depending on the package

When a server requires you to provide the certificate chain explicitly, combine the appropriate CA certificates into a bundle in the correct chain order.

For example:

cat SectigoRSADomainValidationSecureServerCA.crt \
    USERTrustRSAAAACA.crt \
    AAACertificateServices.crt > ca_bundle.crt

This concatenates the three .crt files into ca_bundle.crt. The order matters: begin with the issuer closest to your leaf/domain certificate and continue toward the root as required by your deployment.

2. Convert the Certificate to .PFX

Once the CA bundle is ready, use OpenSSL to create a .pfx file containing:

  • The domain certificate
  • The private key
  • The additional CA certificates

Run:

openssl pkcs12 -export \
  -out certificate.pfx \
  -inkey private.key \
  -in STAR_aaa_net.crt \
  -certfile ca_bundle.crt

The parameters are:

  • -out certificate.pfx → output PKCS#12 file
  • -inkey private.key → private key associated with the domain certificate
  • -in STAR_aaa_net.crt → leaf/domain certificate
  • -certfile ca_bundle.crt → additional CA certificates to include

OpenSSL prompts you for an export password. Store it securely because it is normally required when importing the .pfx file.

3. When Is .PFX Useful?

Common use cases include:

  • Installing TLS certificates in IIS/Windows Server
  • Microsoft Exchange Server
  • Applications that accept PKCS#12 bundles
  • Moving a certificate and its private key between compatible systems

On many Linux deployments using Nginx or Apache, you can work directly with separate certificate, key, and chain files instead of creating a .pfx file.

Conclusion

Creating a CA bundle and exporting a PKCS#12 file with OpenSSL is straightforward once you know which certificate files belong in the chain. Use cat to assemble the required CA certificates and openssl pkcs12 -export to package the certificate, private key, and chain into a .pfx file.

DevOps SSL

Related Posts

.htaccess Rules to Prevent PHP Execution
Published on
.htaccess Rules to Prevent PHP Execution
Public upload directories are a common security-sensitive part of web applications. If an attacker manages to upload a file such as shell.php and the web server executes it, the upload feature can become a route to remote code execution. On Apache, a directory-specific .htaccess configuration can help prevent script execution in locations that should contain only static files. Why .htaccess Can Help Apache supports .htaccess files for directory-level configuration when the server permits the relevant overrides. This makes it possible to apply security rules to a specific directory without changing every virtual-host setting.
DevOps Security Apache htaccess
How to Block IP Ranges with `.htaccess`
Updated on
How to Block IP Ranges with `.htaccess`
One useful feature of Apache is the flexibility of .htaccess. In addition to URL rewriting and caching rules, .htaccess can also restrict access based on IP addresses. If you are dealing with spam bots, brute-force attempts, or unwanted traffic from a particular network, one quick option is to block an individual IP address or an entire range. Block a Single IP Address To block one IP address, use: Copy <RequireAll> Require all granted Require not ip 192.168.1.100 </RequireAll> This blocks 192.168.1.100 while allowing other clients to access the site.
DevOps Apache htaccess Security
How to Whitelist IP Address Ranges with .htaccess
Updated on
How to Whitelist IP Address Ranges with .htaccess
.htaccess is useful for more than URL rewriting and caching. It can also provide an additional access-control layer, including restricting an application to specific IP addresses or IP ranges. This technique can be useful when: An application is still in development and should only be available to an internal team. You want to protect sensitive paths such as /admin or /api. A server should only be reachable from an office network or VPN. Whitelist One IP Address To allow only one IP address:
DevOps Security Apache htaccess
Using Nginx as a Reverse Proxy for a Go Application
Updated on
Using Nginx as a Reverse Proxy for a Go Application
A Go web application often listens directly on an application port such as :8080. If you want users to access it through a normal domain on port 80 or 443, you can place Nginx in front of it as a reverse proxy. Using Nginx in front of a Go service provides several benefits: Client requests reach Nginx before being forwarded to the Go application. TLS termination can be handled at the proxy layer. Multiple application instances can be load balanced. Static assets can be served separately when that architecture makes sense. This guide shows a basic setup.
DevOps Golang Linux Nginx Reverse Proxy
chevron-up