Import an SSL certificate in PFX format onto the Cloudmon Controller and extract the required private key and full certificate chain files for use in Nginx HTTPS configuration.
A PFX (PKCS#12) file is a single, password-protected archive that bundles the private key, the server certificate, and the intermediate/chain certificates together. Nginx, however, requires these components as separate PEM-encoded files.
This article covers the complete workflow: importing the PFX file onto the Cloudmon Controller, extracting it into the required pvt.key and fullchain.crt files, placing them for Nginx use, and validating and reloading the configuration.
.pfx or .p12) issued by your CA.openssl version).Step 1: Import the PFX certificate onto the Cloudmon Controller
Import the PFX file onto the Cloudmon Controller and place it in a working directory:
mkdir -p ~/ssl-import && cd ~/ssl-import
Once the PFX file (e.g. certificate.pfx) is in this directory, confirm it is readable and valid:
openssl pkcs12 -info -in certificate.pfx -noout
You will be prompted for the PFX password. A successful response lists the private key, certificate, and CA chain entries without errors, confirming the PFX is valid before extraction.
Step 2: Extract the private key and full certificate chain
Extract the private key:
openssl pkcs12 -in certificate.pfx -nocerts -nodes -out pvt.key
Extract the full certificate chain:
openssl pkcs12 -in certificate.pfx -nokeys -out fullchain.crt
If required, clean up certificate metadata (bag attributes, subject/issuer lines) left over from extraction:
sed -i '/^Bag Attributes/,/-----BEGIN/{/-----BEGIN/!d}' fullchain.crt
Step 3: Handle legacy PFX files (OpenSSL 3.x)
Older PFX files using legacy encryption (e.g. RC2-40-CBC or 3DES) may fail to extract on OpenSSL 3.x with errors such as:
Mac verify error: invalid password?
error:0308010C:digital envelope routines::unsupported
These errors typically do not mean the password is wrong — OpenSSL 3.x cannot process the legacy encryption algorithm by default. Add the -legacy flag to load the legacy provider:
openssl pkcs12 -legacy -in certificate.pfx -nocerts -nodes -out pvt.key
openssl pkcs12 -legacy -in certificate.pfx -nokeys -out fullchain.crt
Step 4: Place the extracted files in the Cloudmon Controller SSL directory
Copy the extracted files into the Nginx SSL directory used by the Cloudmon Controller:
/etc/nginx/ssl/
Typical files found in this directory:
cloudmon.key
cloudmon.crt
cloudmon_fullchain.crt
cloudmon.key contains the private key.cloudmon_fullchain.crt contains the server certificate along with intermediate CA certificates.Copy the extracted files into place:
cp fullchain.crt /etc/nginx/ssl/cloudmon_fullchain.crt
cp pvt.key /etc/nginx/ssl/cloudmon.key
Set correct ownership and permissions:
chown root:root /etc/nginx/ssl/cloudmon_fullchain.crt /etc/nginx/ssl/cloudmon.key
chmod 644 /etc/nginx/ssl/cloudmon_fullchain.crt
chmod 600 /etc/nginx/ssl/cloudmon.key
Step 5: Validate the extracted certificate files
Check the certificate chain details:
openssl x509 -in fullchain.crt -text -noout
Check the private key:
openssl rsa -in pvt.key -check
Confirm the key and certificate match by comparing their modulus hashes:
openssl x509 -noout -modulus -in fullchain.crt | openssl md5
openssl rsa -noout -modulus -in pvt.key | openssl md5
If the two hashes differ, the key and certificate do not correspond to the same PFX and Nginx will fail to start.
-legacy.-nokeys (not -clcerts) to ensure the full chain is included.-legacy flag to all pkcs12 extraction commands on OpenSSL 3.x.644 on certificate files and 600 on key files, owned by root.nginx -t, then reload Nginx.Test the Nginx configuration syntax:
nginx -t
Then apply the new certificate without dropping active connections:
systemctl reload nginx
Confirm HTTPS is serving the updated certificate. If the issue persists after completing the above steps, collect the outputs from each step and share them with Cloudmon Support for further review.