Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was given two .pem files to import. I did not generate these files. Can I import them into IIS 7 or do they have to be converted into another format? I know that IIS likes .pfx - can .pem's be converted if necessary?

Any help is greatly appreciated!

share|improve this question
up vote 14 down vote accepted

If they're just certificate authorities you're looking to import into a Trusted Roots or Intermediate Roots container, just change the extension to .cer or .crt and Windows should be able to handle it with little issues.

If the .pem files are part of .pem/.key file pairs, then you'll have to convert them into a .pfx file before Windows can touch them. OpenSSL can be used to create such an archive.

openssl pkcs12 -export -out newfile.pfx -inkey privcert.key -in pubcert.pem -certfile CARoots.pem

It will prompt you for a password to protect the file with. Use that password when importing into IIS.

share|improve this answer
Just to clarify, you won't be able to convert the .pem files to a .pfx unless you also have a private key file (privcert.key in the above command). If you aren't able to obtain the same private key files that was used in the process or creating the certificates, you'll need to create a new private key and reissue the certificates. – Robert Mar 10 '11 at 14:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.