Which format your server needs
- PEM (.pem, .crt) — a text format with BEGIN CERTIFICATE lines. Used by Apache, nginx and most hosting control panels.
- DER (.der, .cer) — the same certificate in binary form; common in Java and on Windows.
- PKCS#7 (.p7b) — the certificate together with its chain, without the private key. Certificate authorities often send it for IIS and Tomcat.
- PKCS#12 (.pfx, .p12) — the certificate, chain and private key in one password-protected file. Required for IIS, Exchange, Azure and importing into Windows.
Private key security
Files are sent over a secure connection, processed in memory and never stored. Still, the private key is the certificate's main secret. If you prefer not to upload anything, run the conversion on your own server, for example: openssl pkcs12 -export -out site.pfx -inkey site.key -in site.crt -certfile chain.crt.