I was given two .pem files to import. I did not generate these files. Can I import them into IIS 7 or do they have to be converted into another format? I know that IIS likes .pfx - can .pem's be converted if necessary?

Any help is greatly appreciated!

1 Answer 1


If they're just certificate authorities you're looking to import into a Trusted Roots or Intermediate Roots container, just change the extension to .cer or .crt and Windows should be able to handle it with little issues.

But if the .pem files are part of .pem/.key file pairs, then you'll have to convert them into a .pfx file before Windows can touch them. OpenSSL can be used to create such an archive.

openssl pkcs12 -export -out newfile.pfx -inkey privcert.key -in pubcert.pem -certfile CARoots.pem

It will prompt you for a password to protect the file with. Use that password when importing into IIS.

  • 4
    Just to clarify, you won't be able to convert the .pem files to a .pfx unless you also have a private key file (privcert.key in the above command). If you aren't able to obtain the same private key files that was used in the process or creating the certificates, you'll need to create a new private key and reissue the certificates.
    – Robert
    Mar 10, 2011 at 14:26
  • 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .