Extract Private Key and Chain Files from PFX Certificate for Nginx HTTPS

When using Nginx as a load balancer or a reverse proxy to serve on HTTPS protocol, Nginx expects the SSL certificate to be configured as a private key and chain files.

Please refer to the following commands to extract the key and chain from the certificate:

Create an encrypted key file:

openssl pkcs12 -in certificate.pfx -nocerts -out privkey.key

Extract the server certificate:
 

openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out cert.crt

Extract the CA chain:
 

openssl pkcs12 -in certificate.pfx -cacerts -nokeys -out chain.crt

Create a full chain file:
 

cat cert.crt chain.crt > fullchain.crt