Certificate Output Formats

Choose a format

Format	Common uses	Configuration
PEM	nginx, httpd, and many Linux applications	key_path + fullchain_path
PFX / P12	Windows and applications requiring PKCS#12	pfx_path + password
JKS	Applications using Java KeyStore	jks_path + password + alias

PFX and P12 use the same container format; choose the extension required by the application. CertOne performs conversion internally, without requiring OpenSSL or Java in the runtime environment. Still verify that the application can read the generated format.

Export multiple formats

This complete file target can be added to an existing configuration's targets list:

targets:
  - name: app-keystore
    type: files
    certificates:
      - id: cert-REPLACE
        key_path: /opt/app/tls/key.pem
        fullchain_path: /opt/app/tls/fullchain.pem
        pfx_path: /opt/app/tls/site.pfx
        jks_path: /opt/app/tls/site.jks
        password: REPLACE_WITH_EXPORT_PASSWORD
        alias: website

This example only writes files. If the application needs a reload, add tested local commands to the target.

Use an absolute Windows path for Windows PFX output, for example:

targets:
  - name: pfx-file
    type: files
    certificates:
      - id: cert-REPLACE
        pfx_path: 'C:\ProgramData\CertOne\output\site.pfx'
        password: REPLACE_WITH_EXPORT_PASSWORD

Formats and passwords

• Set a nonempty export password in the output's password field, and restrict access to the configuration containing it.
• PFX and JKS may contain private keys; protect them as private key files.
• PFX and JKS in the same certificate output configuration share one password. Use separate targets and output paths for different passwords.
• Export password changes affect deployment decisions. Update the application's password configuration too.
• JKS output contains one private key entry and its certificate chain. It replaces the specified file; it does not merge arbitrary existing keystores or truststores.
• Do not use an existing JKS file containing other important entries as an output destination.
• PFX uses modern encryption, which older software may not support. Test the target application before enabling automatic updates.
• The built-in IIS target manages its own temporary PFX and does not require a separate export password.