Customer HubConvert certificate to PEM
PFX certificates are used to store digital identities and encryption in a file format. Their conversion is necessary to ensure compatibility between different systems. Conversion to other formats such as PEM allows the certificates to be used in a wider range of applications.
The resulting files server.pem and server.key are used by the reverse proxy (Traefik with static certificates or nginx), see Docker (Recommended) →.
Conversion to separate PEM files
Extract private key from a PFX file to a PEM file
openssl pkcs12 -in filename.pfx -nocerts -out key.pem
Remove the password from the extracted private key
openssl rsa -in key.pem -out server.key
Export the certificate chain
openssl pkcs12 -in filename.pfx -nokeys -out server.pem
server.pem must contain the complete certificate chain: first the server certificate, followed by the intermediate certificates. A root certificate is not required. If the PFX file does not contain any intermediate certificates, they are obtained from the certificate authority and added. The chain can be checked and corrected, for example, on the following page: WhatsMyChainCert →The complete chain is always required, because not all clients fetch missing intermediate certificates themselves. This applies to the Relution agents on the devices as well as to ActiveSync clients connected via the Secure Mail Gateway, as both run through the same reverse proxy.
How the chain is assembled and then put in place for Traefik or nginx is described in Renew a purchased certificate →.