SSL/TLS Certificates: Complete Guide to Generation and Conversion between Formats

Table of Contents

1. Introduction

2. What is an SSL/TLS Certificate?

3. Certificate Formats Explained

4. Certificate Generation with Let's Encrypt and Certbot

5. Conversion between Formats

6. Best Practices and Security

7. Common Troubleshooting

Introduction

SSL/TLS certificates are essential for protecting data in transit over the internet. Whether you are an infrastructure administrator, developer, or IT manager, it is essential to understand how to generate, convert, and manage these certificates.

In this guide, you will learn:

• How to generate Let's Encrypt certificates using Certbot

• The main certificate formats and their differences

• How to convert certificates between various formats (.PEM, .PFX, .P12, .DER, .CRT, .KEY)

• Security and storage best practices

• Solutions for common problems

This article is intended for infrastructure professionals, DevOps, and system administrators in corporate environments.

What is an SSL/TLS Certificate?

An SSL/TLS certificate is a digital document that:

• Authenticates the identity of a web server

• Encrypts communication between client and server

• Validates the trustworthiness of a website

Components of a Certificate

A typical certificate contains:

Certificate (Certificado X.509)
├── Domínios autorizados (CN, SAN)
├── Validade (Data de emissão e expiração)
├── Chave Pública
└── Assinatura da Autoridade Certificadora

Private Key (Chave Privada)
└── Deve ser mantida segura em todas as circunstâncias

Chain (Cadeia de Certificados)
└── Certificados intermediários para validação

Why different formats?

Different applications and platforms support distinct formats:

• Web servers (Nginx, Apache): usually use .PEM

• Windows/IIS: often require .PFX or .P12

• Java applications: may use .JKS or .P12

• Network devices: sometimes use .DER or .CRT

Certificate Formats Explained

PEM (Privacy Enhanced Mail)

• Extension: .pem, .crt, .key

• Content: ASCII text with delimiters -----BEGIN/END

• Components: Supports private key, certificate, and certificate chain in separate or single files

• Used in: Nginx, Apache, OpenSSL, Linux/Unix

• Example:

-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7...
-----END PRIVATE KEY-----

-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIJAKZ6gLSQ8Y/sMA0GCSqGSIb3DQEBAQUAD...
-----END CERTIFICATE-----

PFX and P12 (PKCS#12)

• Extension: .pfx, .p12

• Content: Binary (proprietary format)

• Components: Contains certificate, private key, and chain in a single file

• Protection: Password-protected

• Used in: Windows/IIS, some Java applications, export/backup

• Advantage: Single file, portable, password-protected

DER (Distinguished Encoding Rules)

• Extension: .der, .cer

• Content: Binary

• Components: Only public certificate (no private key)

• Used in: Systems that only need to validate certificates

• Note: Not recommended for standalone production use

CRT (Certificate)

• Extension: .crt

• Content: Can be PEM or DER

• Note: Same function as .cer; format varies by system

KEY (Private Key)

• Extension: .key

• Content: Usually PEM

• Note: Contains only the private key

• Security: Critical to keep protected and with restricted permissions (chmod 400/600)

CSR (Certificate Signing Request)

• Extension: .csr

• Content: Request for CA to sign a certificate

• Note: Not a certificate; it will be signed to generate the final certificate

Certificate Generation with Let's Encrypt and Certbot

Prerequisites

# Debian/Ubuntu
sudo apt-get update
sudo apt-get install certbot

# RHEL/CentOS
sudo yum install certbot

# Validar instalação
certbot --version

Method 1: DNS Challenge (Recommended for Wildcards)

This method is ideal for wildcard certificates (*.exemplo.com.br) and environments without a direct web server.

Step 1: Generate the Certificate

sudo certbot certonly \
  --manual \
  --preferred-challenges dns \
  -d "*.exemplo.com.br" \
  -d "exemplo.com.br" \
  --agree-tos \
  --email [email protected]

Explained parameters:

• certonly: Generates only the certificate, without modifying configurations

• --manual: Allows full control of the process

• --preferred-challenges dns: Uses DNS validation

• -d: Defines domains (repeat for multiple)

• --agree-tos: Accepts the terms of service

• --email: Contact for renewal notifications

Step 2: Validate the DNS Challenge

Certbot will ask you to add a TXT record in DNS:

_acme-challenge.exemplo.com.br. IN TXT "xxxxxxxxxxxxxxxxxxxxx"

On your DNS provider (Cloudflare, Route53, etc.):

1. Access the DNS panel

2. Create a new TXT record with the provided key

3. Wait for propagation (up to 2 minutes)

4. Press Enter in Certbot to continue

Step 3: Validate Installation

The certificates will be saved in:

/etc/letsencrypt/live/exemplo.com.br/
├── cert.pem           # Seu certificado
├── privkey.pem        # Sua chave privada
├── chain.pem          # Certificados intermediários
└── fullchain.pem      # Certificado + cadeia

Method 2: HTTP Challenge (Recommended for Development)

If you have a web server running:

sudo certbot certonly \
  --webroot \
  -w /var/www/html \
  -d "exemplo.com.br" \
  --agree-tos \
  --email [email protected]

Automatic Renewal

# Testar renovação
sudo certbot renew --dry-run

# Certbot configura renovação automática via systemd ou cron
# Validar:
sudo systemctl status certbot.timer    # Systemd
sudo crontab -l                        # Cron

Conversion between Formats

1. PEM to PFX/P12

Combines certificate, private key, and chain into a single password-protected file.

Step by Step

# Navegar para o diretório de certificados
cd /etc/letsencrypt/live/exemplo.com.br/

# Converter para PFX
openssl pkcs12 -export \
  -out exemplo.com.br.pfx \
  -inkey privkey.pem \
  -in cert.pem \
  -certfile chain.pem

What happens:

1. OpenSSL will ask for a protection password

2. The .pfx file will be created

3. This file can be transported securely

Detailed syntax:

openssl pkcs12 -export         # Exportar para PKCS#12
  -out arquivo.pfx             # Arquivo de saída
  -inkey privkey.pem           # Chave privada
  -in cert.pem                 # Certificado público
  -certfile chain.pem          # Certificados intermediários

Optional - Without password protection (not recommended):

openssl pkcs12 -export \
  -out exemplo.com.br.pfx \
  -inkey privkey.pem \
  -in cert.pem \
  -certfile chain.pem \
  -passout pass:

2. PFX/P12 to PEM

Extracts individual components from a PFX file.

Extract Certificate

openssl pkcs12 -in exemplo.com.br.pfx \
  -clcerts \
  -nokeys \
  -out cert.pem \
  -legacy

Parameters:

• -clcerts: Includes only client certificates

• -nokeys: Does not include private keys

• -legacy: Compatibility with older certificates

Extract Private Key

openssl pkcs12 -in exemplo.com.br.pfx \
  -nocerts \
  -out privkey.pem \
  -nodes \
  -legacy

Parameters:

• -nocerts: Does not include certificates

• -nodes: Does not encrypt the private key (plain text output)

• -legacy: Compatibility with older formats

Extract Certificate Chain

openssl pkcs12 -in exemplo.com.br.pfx \
  -nokeys \
  -cacerts \
  -out chain.pem \
  -legacy

Parameters:

• -cacerts: Extracts only CA certificates

Automated Script for Complete Extraction

#!/bin/bash

arquivo_pfx="exemplo.com.br.pfx"
senha="sua_senha_aqui"

echo "Extraindo certificado..."
openssl pkcs12 -in "$arquivo_pfx" \
  -clcerts -nokeys -out cert.pem \
  -passin pass:"$senha" -legacy

echo "Extraindo chave privada..."
openssl pkcs12 -in "$arquivo_pfx" \
  -nocerts -out privkey.pem \
  -nodes -passin pass:"$senha" -legacy

echo "Extraindo cadeia..."
openssl pkcs12 -in "$arquivo_pfx" \
  -nokeys -cacerts -out chain.pem \
  -passin pass:"$senha" -legacy

echo "Concluído! Arquivos gerados:"
ls -lh cert.pem privkey.pem chain.pem

3. PEM to DER

Converts text format to binary.

openssl x509 -in cert.pem -outform DER -out cert.der

4. DER to PEM

Converts binary format to text.

openssl x509 -in cert.der -inform DER -out cert.pem

5. Extract Private Key from Combined PEM

If you have a PEM file with certificate and key:

openssl pkey -in arquivo_combinado.pem -out privkey.pem

6. Create Single PEM Certificate (fullchain)

cat cert.pem chain.pem > fullchain.pem

Quick Reference Table

Best Practices and Security

1. Private Key Protection

# Definir permissões corretas (apenas leitura para owner)
chmod 400 privkey.pem

# Verificar proprietário
ls -lh privkey.pem
# Deve ser: -r-------- 1 root root

# Nunca commit em Git (adicionar ao .gitignore)
echo "privkey.pem" >> .gitignore
echo "*.pfx" >> .gitignore

2. Secure Backup

# Criar backup criptografado
tar czf - /etc/letsencrypt/ | \
  openssl enc -aes-256-cbc -salt -out certs_backup.tar.gz.enc

# Restaurar backup
openssl enc -d -aes-256-cbc -in certs_backup.tar.gz.enc | tar xz

3. Certificate Validation

# Verificar validade
openssl x509 -in cert.pem -text -noout | grep -A2 "Validity"

# Verificar domínios (CN e SAN)
openssl x509 -in cert.pem -text -noout | grep -A1 "Subject:"
openssl x509 -in cert.pem -text -noout | grep "DNS:"

# Verificar emissão e expiração
openssl x509 -in cert.pem -noout -dates

4. Match Key and Certificate

# Calcular hash da chave privada
openssl pkey -in privkey.pem -pubout -outform pem | \
  openssl dgst -sha256 -hex

# Calcular hash do certificado
openssl x509 -in cert.pem -pubkey -noout | \
  openssl dgst -sha256 -hex

# Se os hashes forem iguais, a chave e certificado combinam

5. Expiration Monitoring

#!/bin/bash
# Script para alertar sobre certificados expirando

cert_file="cert.pem"
dias_alerta=30

dias_restantes=$(openssl x509 -in "$cert_file" -noout -dates | \
  grep "notAfter" | cut -d= -f2 | \
  xargs -I {} date -d {} +%s | \
  awk "{print int(($1 - $(date +%s))/86400)}")

if [ "$dias_restantes" -lt "$dias_alerta" ]; then
  echo "ALERTA: Certificado expira em $dias_restantes dias!"
  # Enviar email, Slack, etc.
fi

6. Nginx Configuration with Certificates

server {
  listen 443 ssl http2;
  server_name exemplo.com.br www.exemplo.com.br;

  ssl_certificate /etc/letsencrypt/live/exemplo.com.br/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/exemplo.com.br/privkey.pem;

  # Protocolos seguros
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_ciphers HIGH:!aNULL:!MD5;
  ssl_prefer_server_ciphers on;

  # HSTS (recomendado)
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

  # Seu conteúdo aqui
  root /var/www/html;
  index index.html;
}

# Redirecionar HTTP para HTTPS
server {
  listen 80;
  server_name exemplo.com.br www.exemplo.com.br;
  return 301 https://$server_name$request_uri;
}

7. Apache Configuration with Certificates

<VirtualHost *:443>
  ServerName exemplo.com.br
  ServerAlias www.exemplo.com.br

  SSLEngine on
  SSLCertificateFile /etc/letsencrypt/live/exemplo.com.br/cert.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/exemplo.com.br/privkey.pem
  SSLCertificateChainFile /etc/letsencrypt/live/exemplo.com.br/chain.pem

  # Protocolos seguros
  SSLProtocol -all +TLSv1.2 +TLSv1.3
  SSLCipherSuite HIGH:!aNULL:!MD5

  # HSTS
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

  DocumentRoot /var/www/html
</VirtualHost>

<VirtualHost *:80>
  ServerName exemplo.com.br
  ServerAlias www.exemplo.com.br
  Redirect permanent / https://exemplo.com.br/
</VirtualHost>

Common Troubleshooting

Error: "mac verify failure" when extracting PFX

# Geralmente causado por senha incorreta
openssl pkcs12 -in arquivo.pfx -text -passin pass:suasenha

Solution:

# Tente com -legacy
openssl pkcs12 -in arquivo.pfx -nodes -out temp.pem -legacy

Error: "Unable to load certificate" in Nginx

# Validar sintaxe
nginx -t

# Verificar permissões
ls -lh /etc/letsencrypt/live/seu-dominio/

# Certificado deve ser legível por nginx
sudo chown root:root /etc/letsencrypt/
sudo chmod 755 /etc/letsencrypt/

Error: "certificate required" when using PFX without chain

# Certificado incompleto, recriar com -certfile
openssl pkcs12 -export \
  -out completo.pfx \
  -inkey privkey.pem \
  -in cert.pem \
  -certfile chain.pem    # Não esquecer este arquivo

IIS Does Not Recognize PFX

# Windows requer formato específico
openssl pkcs12 -export \
  -out arquivo.pfx \
  -inkey privkey.pem \
  -in cert.pem \
  -certfile chain.pem \
  -name "Friendly Name"

Incompatible Certificate after Let's Encrypt Update

# Let's Encrypt mudou para ECDSA em 2024
# Se precisar de RSA:
sudo certbot certonly \
  --manual \
  --key-type rsa \
  --rsa-key-size 2048 \
  -d seu-dominio.com.br

Verify Certificate Installed on Server

# Via SSH (Linux)
echo | openssl s_client -servername exemplo.com.br -connect exemplo.com.br:443 2>/dev/null | \
  openssl x509 -noout -dates -subject

# Via CLI (qualquer SO)
openssl s_client -connect exemplo.com.br:443 -showcerts < /dev/null

Conclusion

SSL/TLS certificates are essential for modern security. This guide covered:

✅ Generation via Let's Encrypt and Certbot
✅ Conversion between PEM, PFX, DER formats
✅ Best practices of security and protection
✅ Troubleshooting of common problems

Next Steps

1. Review your backup and certificate rotation policies

2. Implement expiration monitoring

3. Configure HSTS and other security headers

4. Test automatic renewal regularly

5. Keep audit logs of changes

Additional Resources

• Let's Encrypt Documentation

• Certbot Documentation

• SSL Labs Best Practices

• Mozilla SSL Configuration Generator

Questions or suggestions? Leave a comment below or contact our infrastructure team.

Last updated: August 2026