Complete one of the following procedure to convert PFX certificate to PEM format for use with NetScaler:
NetScaler Wizard
Complete the following procedure to convert a PFX certificate to PEM format using NetScaler Wizard:
-
Navigate to Traffic Management, Select the SSL node.
-
Click the Import PKCS#12 link.
-
Specify a file name you want for the PEM certificate in the Output File Name field.
-
Click Browse and select the PFX certificate that you want to convert to PEM format. Some users prefer to upload the certificate to /ncsonfig/SSL directory and use it from there. If PFX certificate is stored on NetScaler then choose option Appliance and if it stored on your workstation then use Local.
-
Specify the Import Password.
-
Click OK.
-
If the file is encoded, then select DES or 3DES as the Encoding Format:
-
Specify the PEM Passphrase and the Verify PEM Passphrase.
-
Click the Manage Certificates / Keys / CSRs link to view the converted PEM certificate files.
-
You can view the uploaded PFX file with the converted PEM file.
-
Expand the SSL node.
-
Select the Certificates node.
-
Click Install.
-
Specify a Certificate-Key Pair Name in the Install Certificate wizard.
-
Browse to the PEM file for both the Certificate File Name and Private Key File Name.
-
Specify the Password.
-
Click Install.
-
Bind the certificate key pair to an SSL load balancing virtual server or NetScaler Gateway virtual server.
OpenSSL Utility
If you have requested and installed a certificate onto a Windows server using the Internet Information Service (IIS) certificate wizard, you can export that certificate with its private key to a Personal Information Exchange (PFX) file. To import this certificate onto the NetScaler Gateway, you must convert the PFX file to unencrypted PEM format.
You can use the open source utility OpenSSL to perform the conversion from PFX to PEM. Download a Win32 distribution of OpenSSL from Win32 OpenSSL.
You might also need C++ redistributable files if you want to use OpenSSL. Download this from Microsoft Visual C++ 2008 Redistributable Package (x86).
To convert a PFX file to a PEM file, complete the following steps on a Windows machine:
-
Download and install the Win32 OpenSSL package from Win32 OpenSSL.
-
Create a folder c:certs and copy the file yourcert.pfx into the c:certs folder.
-
Open command prompt and change into the OpenSSLbin directory:
cd %homedrive%OpenSSLbin -
Run the following command to convert the PFX file to an unencrypted PEM file (all in one line):
openssl pkcs12 -in c:certsyourcert.pfx -out c:certscag.pem –nodes
-
When prompted for the import password, enter the password you used when exporting the certificate to a PFX file. You should receive a message that says MAC verified OK.
-
Point a browser to the NetScaler Gateway administration portal or HTTPS port 9001: https://netscaler-gateway-server:9001.
-
Log on as root. The default password is rootadmin.
-
Click the Maintenance link at the top of the page.
-
Click the Browse button next to the Upload Private Key+Certificate (.pem) field. Browse to the c:certscag.pem file and click Upload.
-
Restart NetScaler Gateway for the new SSL certificate to be applied.