Service Status Submit a Request go back to rebel.com

What SSL Certificate Formats Does Rebel Provide? (PEM vs. PFX)

Articles in this section

See more
Avatar
Israel
Updated
Follow
When you purchase or renew an SSL certificate through Rebel, your certificate files are issued in standard PEM format (.crt, .cer, .pem).
 
If your web server, hosting platform, or IT administrator requests a PFX or PKCS#12 file (.pfx, .p12), this guide outlines what format Rebel supplies, why PFX files are not provided directly, and where to look if your setup requires a conversion.
 

What We Deliver: Standard PEM Format

Through our Certificate Authority partner (GlobalSign), all Rebel SSL certificates are issued and delivered strictly in standard PEM (Privacy-Enhanced Mail) format.
  • File Types: Plain-text files ending in .crt, .pem, or .cer.
     
  • Appearance: Base64-encoded text blocks starting with -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE-----.
     
  • Standard Platforms: Supported by default across most web servers and hosting control panels, including Apache, Nginx, cPanel, Plesk, Linux environments, AWS, and Cloudflare.
     
  • Separation of Files: In PEM format, components are managed as individual files:
    1. Primary Certificate (.crt / .pem): The domain certificate issued to you.
       
    2. CA Intermediate Chain: The intermediate certificate linking your site to GlobalSign's trusted root authority.
       
    3. Private Key (.key): The secret key created locally on your server or hosting control panel at the exact time the Certificate Signing Request (CSR) was generated.

Why Rebel Does Not Supply .PFX Files

Certain hosting environments—most notably Microsoft Windows Server (IIS), Microsoft Exchange, and Microsoft Azure—often request a bundled archive file format known as PFX or PKCS#12 (.pfx / .p12).
 
A .pfx file is a single package that requires bundling your certificate, the intermediate chain, and your server's secret Private Key.
Rebel Support & Security Policy: Rebel cannot generate, build, convert, or supply a .pfx file for you.
Under global CA/Browser Forum security requirements, your Private Key is created directly within your own server environment and must remain strictly confidential to you. Rebel and GlobalSign never see, store, or have access to your private key. Because we do not possess your private key, it is technically impossible for us to assemble a .pfx archive on your behalf.

Third-Party Conversion & Server Support Notice

Important Support Scope: Rebel Customer Support provides guidance and technical assistance solely for the PEM-formatted certificates issued through our platform.
We do not offer direct technical support, troubleshooting, or execution services for file format conversions, third-party software utilities, or external server environments (such as Microsoft IIS or Azure).
If your environment strictly requires a .pfx file, these steps and external resources will help point you in the right direction:
  • Completing the Request in Windows / IIS: If you generated your CSR inside Microsoft IIS, you typically do not need a conversion. You can complete the pending certificate request directly inside IIS using your issued .crt file. Once completed, Windows allows administrators to export the certificate as a .pfx archive from the local certificate store.
     
  • Command-Line Tools (OpenSSL): System administrators frequently use local command-line tools like OpenSSL to bundle their .crt, intermediate certificate, and private key into a .pfx file. Searching online for "convert CRT and Private Key to PFX using OpenSSL" will provide standard syntax examples.
     
  • Web-Based Conversion Tools: There are numerous third-party SSL converter tools available on the web. You can search online for "PEM to PFX converter" or "SSL converter" to locate independent conversion platforms. (Note: For production or business-critical websites, handling keys locally on your own machine or server is always recommended).

Need the Intermediate Certificate?

If your setup requires GlobalSign's intermediate certificate to complete the bundle, you can download the matching intermediate certificate directly from GlobalSign:
 

Comments

0 comments

Please sign in to leave a comment.