Simple definition
PKCS#12 is a binary container format, commonly stored with the .p12 or .pfx extension, that can bundle a certificate, its private key, and the associated certificate chain.
Technical definition
PKCS#12 can transport several cryptographic objects in one password-protected file. It is widely used to export or import a TLS identity between systems, web servers, appliances, and certificate stores.
How it works / role
During export, the public certificate and, when exportable, its private key are packaged together with the selected intermediate certificates. During import, the target system restores these objects into its certificate store. The private key is required when a server must prove that it owns the certificate identity.
What is it used for?
Migrate a server certificate together with its private key, back up a cryptographic identity, or import a client certificate onto another system.
Practical example
An IIS certificate is exported to a PFX file with its private key and then imported on a second server so that both systems can present the same TLS identity.
Common issues
- The file password is forgotten or incorrect
- The certificate is exported without its private key
- The intermediate certificate chain is missing or incomplete
- The PKCS#12 encryption algorithm is incompatible with an older device
Key takeaway: A PFX/P12 file may contain a private key; protect it as a secret, restrict access, and remove temporary copies after import.