I am trying to install an SSL Certificate in IIS on Windows Server. It only accepts the .pfx file format for importing & installing an SSL certificate for hosted applications.

  1. I downloaded and installed OpenSSL for Windows from here.
  2. I placed the .crt file & .key file into C:\Program Files\OpenSSL-Win64\bin.
  3. Then I ran this command to generate a random file:

    set RANDFILE=C:\Program Files\OpenSSL-Win64\bin\<RANDOMFILENAME>.rnd
  4. Then I ran this command to give a path of config file:

    set OPENSSL_CONF=C:\OpenSSL-Win64\bin\openssl.cfg
  5. Finally, I ran this command

    openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt

The result of this was:

unable to load private key
140406554043456:error:0909006C:PEM routines:
get_name:no start line:../crypto/pem/pem_lib.c:745:Expecting: ANY PRIVATE KEY

I want to know if I'm making any mistake in the steps that I followed. I also want to know the reason of this error.


Let me explain what all of these files are and what they mean. Then the solution will become more obvious:

What is a public and private key?

Public and private keys are two parts of a key, used for asymmetric encryption. They are mathematically related, and are generated together. The public key, as the name suggests, can be made public without any loss of security. In fact, it's necessary so others can send messages.

When sending a message, the sender uses the recipients public key to encrypt a message. The recipient then uses their corresponding private key to decrypt the message.

While there are no standardized extensions for public and private key files, commonly chosen names are myname.pub.pem and myname.priv.pem. Some people use myname.pub.key and myname.key (or myname.priv.key), but on Linux systems, extensions are not important.

What is a certificate?

A certificate is a public key, which was signed by another certificate. The way this works is that someone creates a certificate signing request, which contains their public key and is signed by their private key. The request also contains other identification information, such as domain name, e-mail address, etc., depending on the intended purpose of the certificate. The request is then sent to a certificate authority, which validates this information somehow and then signs the request (or not).

The result of this signature is a certificate, which is basically this:

Hello, my name is Alice and my public key is


Bob has signed that I am Alice. Bob's certificate is below:

Hello, my name is Bob and my public key is


Claus has signed that I am Bob. Claus' certificate is below:


This would keep going until someone eventually signs their own certificate. This means they claim to be who they are, and you should just trust them. These certificates are called "root certificates" and are shipped together with your operating system.

Since a certificate is, in it's most basic sense, a public key with "stuff added to it", you still need the corresponding private key to use it. You can download certificates from other websites too, but without the corresponding private key, you cannot use them in any way.

What is a PKCS #12 file?

In the broadest terms, a PKCS #12 file is a bundle of cryptographic things. As stated above, in order to use a certificate, you need the corresponding private key. To make things "simple" for deployment, the certificate and the private key are often bundled together in one PKCS #12 file (e.g. myname.pfx).

Of course, PKCS #12 offers much more, and Wikipedia gives a good overview over its features.

So, what is the problem?

The problem is in the following line:

openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt

What this does is take a certificate (certificate.crt) and a private key (privateKey.key) and bundles them into one PKCS #12 file (certificate.pfx).

The error "unable to load private key" and "Expecting: ANY PRIVATE KEY" indicate that what you provided is no private key. What exactly the reason for this is can't be deducted from the information you provided, but here are some wild guesses:

  • You didn't see that privateKey.key was a placeholder and your file is named differently.
  • You didn't change into the correct working directory where the certificate and private key were.
  • You used your public key instead of your private key.
  • You don't have correct permissions for your private key.
  • Your private key is not in a recognized format (e.g. newline shenanigans)

I hope this explains the situation well enough and gives you enough pointers to go by to find a solution.

  • Hey MechMK1, that was a fine answer! Perhaps, I understood the basics of those keys, conversion of .crt & .key into .pfx & installing it into Windows IIS Server. I was also successful in installing a .pfx into a production server. The hosted application was working fine on HTTPS after .pfx installation. Regarding the wild guesses, can you please explain more about the correct permissions that I need to have for the private key. Is it like my computer should be in the same domain specified in the Certificate Signing Request? – Rajas Jun 13 at 13:07
  • @Rajas If you have an additional question, please open a new question. This should give you more options to clearly state your question and allow more people to write focused answers. – MechMK1 Jun 13 at 15:15
  • Ok I'll create a new question to get a detailed answer. Can you please let me know if the process that I have posted above is correct or I have made any mistake in it? – Rajas Jun 19 at 6:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.