Need help in creating a .PFX file for SSL Certificate Installation

[Rajs1991]

I am trying to install an SSL Certificate in IIS on Windows Server. It only accepts the .pfx file format for importing & installing an SSL certificate for hosted applications.

(My machine is running on Windows 10 64-bit home edition & the target server is Windows IIS 10)

1. I downloaded and installed OpenSSL for Windows from here
2. I placed the .crt file & .key file into C:\Program Files\OpenSSL-Win64\bin.
3. I entered into OpenSSL installed directory from command prompt.

4. Then I ran this command to generate a random file: set RANDFILE=C:\Program Files\OpenSSL-Win64\bin\<RANDOMFILENAME>.rnd

5. Then I ran this command to give a path of config file: set OPENSSL_CONF=C:\OpenSSL-Win64\bin\openssl.cfg

6. Finally, I ran this command: openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt

7. The result of this was: unable to load private key 140406554043456:error:0909006C:PEM routines: get_name:no start line:../crypto/pem/pem_lib.c:745:Expecting: ANY PRIVATE KEY

I want to know if I'm making any mistake in the steps that I followed & the filenames or file formats are being wrong (random file, conf file, crt file & key file etc). I also want to know the reason of this error. I have tried reaching out to GoDaddy technical team but they are not able to provide any solution even if the SSL certificate is purchased from GoDaddy.

[Zulfiqar]

Hello Rajs1991, I hope you are well.  You are not following right steps.   When you're creating a .pfx, you'll need a copy of the private key from your server, as well as the .crt file that you downloaded from GoDaddy. You can use OpenSSL commands in command line to create the PFX, I'm including a sample below:

openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile more.crt

This will create a certificate.pfx file from your private key, as well as the .crt you downloaded. You'll just need to make sure that you update the names in the sample code above to match your certificate/private key information.

Please follow these guides;

https://pk.godaddy.com/help/download-my-ssl-certificate-files-4754

https://pk.godaddy.com/help/windows-install-codedriver-signing-certificate-and-create-pfx-file-2698

[Rajas]

Hi @Zulfiqar! Thanks for your response. Following are some more inputs which will make my question more specific.

1. I have the copy of generated-private-key.key file & GoDaddy .crt file. I changed the file names  before executing the OpenSSL command. I even created the random file & config file.

2. The SSL certificate that I got from GoDaddy is a wildcard certificate, which I used to install on multiple subdomains of a customer. It was successful. Now while, creating the .pfx file once again, I'm facing this problem.

One of the links that you shared suggests that .pfx file should be created only on the server which was used to create .csr file. In our case, we got the .csr file from GoDaddy as it was a wildcard certificate.

What can I do now?

(Thanks in advance. I appreciate your help.)

[Sandy123]

I am facing the exact same issue.

Did not get any help from call center.

Unable to generate .pfx from private key and crt files.

[Patrick11 · Accepted solution]

I was running into the same issue not being able to export our wildcard as .pfx format needed for the servers that we wanted to attach the certificate to.  Here are the steps from start to finish that we did to get the certificate in the format we needed.

1. Create a certificate request using the certificate snap-in in the mmc console.

2. Used the generated csr to key our wildcard certificate.

3. With the wildcard in hand, installed the certificate into IIS using the option for "Complete Certificate Request".  Found in IIS under "Server Certificates".

4. After the certificate was installed, chose the option to "View..." certificate.

5. Click on the "Details" tab and chose option to "Copy to File...".

6. Select, Yes to export the private key.

7. Chose option to export as .PFX.

In step 3, in the field "File name containing the certification authority response", I chose the .crt provided by GoDaddy.  Friendly name I just used the common name I gave to our certificate. Left the store set to default.

Hope this helps.

[Rajas]

Thanks @Patrick11!