Certificate name is: mycert.crt My CSR converted to PEM (RsA) Private key is: private.key

I want to create mycert.pfx so I can use it in IIS.

When I run this command:

openssl pkcs12 -export -out mycert.pfx -inkey private.key -in mycert.crt

openssl then asks:

RSA public, private, or PKCS #8 key file to decode:

What do I put for that value? If I already added the key to the original command.

Also, am I supposed to use the decrypted CSR as the -inkey file?

1 Answer 1


I think you're confusing terms. CSR stands for Certificate Signing Request. It is not the same as your private key. If you really are passing your CSR file to openssl as the private key, that's your problem. You need to get the actual private key file and use that instead. Where your private key is depends on how you originally generated the CSR.

  • Actually, I was running opensslkey.exe incorrectly and it was asking me for the extra info. Used normal openssl and everything works now.
    – Developr
    Nov 26, 2013 at 15:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .