If you've been sent a CER file to enable SSL on your website, and you didn't start a certificate request for that website, forget it, you've been sent the wrong thing.
On Windows, a PFX file can contain a private key, and that's the part that enables you to encrypt stuff which can be verified with the public key (certificate) associated with it. When you have a working TLS/SSL capable certificate, you'll see a "You have a private key associated with this certificate" message at the bottom of the General page for that certificate. No key = no signing/encryption.
If you've been sent a CA certificate, or a self-signed certificate for a target website to enable you to do SSL to it without errors, then fair enough; you can jam it into the Trusted Root Certificate Authorities store, and then hope the target organization is trustworthy and isn't about to start impersonating other websites on you.
Alternatively, they can buy a certificate from a reputable public CA.