How to Install PFX Certificate via Command Line

Install a PFX certificate via command line by using Import-PfxCertificate on Windows, or by splitting the file into PEM format for Linux and macOS. On Unix-like systems, you must extract the private key and certificate separately before importing them into the system trust store to ensure both identity and encryption capabilities are properly configured.

Understanding PFX Files and Command Line Requirements

A Personal Information Exchange (PFX) file is a binary container that bundles an SSL/TLS certificate along with its associated private key and any intermediate certificates. This format is widely used for backing up and transferring certificate data between servers. When working from a command line interface, you cannot simply "drop" this file into a trust store because most operating systems require the private key and the public certificate to be handled distinctly for security reasons. The method of installation varies significantly depending on your operating system. Windows provides native PowerShell cmdlets that handle the binary parsing automatically. In contrast, Linux distributions and macOS rely on OpenSSL utilities or specific system security tools that expect Privacy-Enhanced Mail (PEM) encoded text files. Therefore, the first step for non-Windows environments is almost always converting the binary PFX structure into readable PEM components.

Windows Installation Using PowerShell

Windows offers the most straightforward path for administrators due to the built-in Import-PfxCertificate cmdlet available in PowerShell 3.0 and later. This command allows you to specify the file path, the password protecting the private key, and the target store location. To install a PFX certificate into the current user's personal store, open PowerShell as an administrator and run the following command:

Import-PfxCertificate -FilePath "C:\certs\mycertificate.pfx" -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String "YourPassword" -AsPlainText -Force)

If you need to install the certificate for all users on the machine, change the store location to Cert:\LocalMachine\My. You will also need to run the script with elevated privileges. The -Exportable flag can be added if you need to allow the private key to be exported later, though this is generally discouraged for high-security environments. Always verify the installation by checking the Certificate Manager console or running Get-ChildItem Cert:\CurrentUser\My.

Preparing PFX Files for Linux and macOS

On Linux and macOS, the native trust stores do not natively accept binary PFX files directly via simple import commands. Instead, you must use OpenSSL to split the PFX file into two separate PEM files: one containing the private key and another containing the certificate chain. This process ensures that the private key remains secure and distinct from the public certificate data. First, extract the private key from the PFX file. This command prompts you for the PFX password and then asks you to set a new password for the decrypted key file. For production use, it is recommended to remove the passphrase from the key file after extraction, but this makes the key less secure against unauthorized access if the file is stolen.

openssl pkcs12 -in certificate.pfx -nocerts -out key.pem -nodes

Next, extract the certificate portion. This creates a file containing the certificate and any intermediate CA certificates in PEM format.

openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out cert.pem

You now have two files: key.pem for the private key and cert.pem for the certificate. These files are ready for platform-specific installation steps.

Installing on Linux Systems

Linux distributions typically manage certificates through the /etc/ssl/certs directory or via update-alternatives scripts like update-ca-certificates. However, for application-specific identities, such as web servers or API clients, the placement depends on the software configuration. For system-wide trust, copy cert.pem to /usr/local/share/ca-certificates/ and run sudo update-ca-certificates. If you are configuring a service like Nginx or Apache, point the configuration directives to the cert.pem and key.pem files created earlier. Ensure file permissions are strict; the private key should be readable only by root or the specific service user (chmod 600 key.pem).

Installing on macOS Systems

macOS uses the security command-line tool to manage the Keychain. A common misconception is that security add-certificate imports the private key. It does not. This command only adds the public certificate to the login keychain. To fully utilize a PFX-derived identity, you must perform two distinct steps. First, add the private key to the keychain. This command imports the decrypted PEM key and associates it with the login keychain.

security import key.pem -k ~/Library/Keychains/login.keychain-db -T /usr/bin/security

Second, add the certificate itself.

security import cert.pem -k ~/Library/Keychains/login.keychain-db -T /usr/bin/security

After importing, you may need to manually link the key and certificate in the Keychain Access app if they do not auto-match, ensuring the private key is marked as "Always Trust."

Troubleshooting Common Issues

When installing certificates via command line, permission errors are the most frequent obstacle. Ensure you are running with sufficient privileges, such as sudo on Linux/macOS or Administrator mode on Windows. Another common issue is password handling. If your PFX password contains special characters, you may need to escape them or use a variable to pass the string securely. Additionally, verify that the certificate chain is complete. If an intermediate certificate is missing from the PFX or the extracted PEM file, applications may fail to validate the connection. Use openssl x509 -in cert.pem -text -noout to inspect the certificate details and confirm the issuer matches your expected Certificate Authority.

Frequently Asked Questions

Can I import a PFX file directly into the Linux trust store without splitting it?

No, standard Linux trust stores do not accept binary PKCS#12/PFX files directly. You must convert the file to PEM format using OpenSSL and place the resulting certificate file in the appropriate directory before updating the CA bundle.

Why does my website still show a certificate error after importing the PFX on Windows?

This often happens if the private key is not marked as exportable or if the certificate was installed in the wrong store (e.g., User instead of LocalMachine). Verify the certificate appears in the correct store and that the private key is linked correctly in the Certificate Manager.

Is it safe to remove the password from the private key PEM file?

Removing the password simplifies automation but reduces security. If the key.pem file is accessed by an attacker, they can decrypt traffic immediately. Only remove the passphrase if you implement strict file permissions and other compensating controls.

What should I do if the security import command fails on macOS?

Ensure you are targeting the correct keychain database file, which is usually login.keychain-db on newer macOS versions. Also, verify that the key.pem file is properly formatted and not corrupted during the OpenSSL extraction process.

How can I verify the certificate was installed correctly on Linux?

Run openssl s_client -connect hostname:443 -servername hostname to see the certificate chain presented by the server. Alternatively, check the system trust store by listing certificates in /etc/ssl/certs or using keytool if managing Java applications.