Separate encoding from contents
PEM wraps binary DER in labeled base64 text. Changing a certificate from PEM to DER changes its representation, not its identity, public key, validity period or issuer signature. This tool retains the parsed certificate and CSR DER bytes in public exports so the signed object is not regenerated.
PFX, also called PKCS12, is a container that can hold certificates and private keys. It has its own encryption and password-integrity structure. A file named .pfx is not guaranteed to be encrypted, supported or associated with the certificate you intended to deploy.
Choose a supported conversion path
For certificates only, use the public PEM/DER ZIP. For extracting a private key from a supported PFX, choose encrypted PKCS8 PEM output and set a new strong password. To build a PFX, provide a supported key and its matching certificate, include any intermediates you need, then select the PFX operation.
New sensitive output uses PBES2 with PBKDF2-HMAC-SHA256 and AES-256-CBC. PFX also receives a SHA-256 password MAC. Outputs are reopened locally before download is offered. This catches creation failures, but the destination application may still have different algorithm or container requirements.
Verify the target application and retain originals
Modern encryption can be incompatible with older systems. This workbench refuses legacy RC2/3DES instead of silently weakening the output. If an older application needs a different format, use its documented supported local export process and assess that requirement in your own environment.
Rebuilt PFX does not preserve original friendly names or localKeyId bag labels. Check the resulting certificate, private-key association and chain in the destination application before replacement. Keep the original files until deployment succeeds. Store encrypted downloads and their passwords separately; weak passwords remain vulnerable to offline guessing.