I tried to following this link to convert a .pfx file to the .cer and .pvk file pair.

When I run this command,

"C:\Program Files (x86)\Microsoft\PVKConverter\PVKConverter.exe" -i TDE_Cert.pfx -o Out_Cert -d mydecryptpassw

It DOES NOT produce any file, nor does it give any error.

Could someone help?

  • Silly question and it should have yielded a file not found error of some sort, but did you try with full paths for input and output files? – Aaron Bertrand Dec 12 '18 at 20:00
  • I actually had the above command wrapped inside a .bat file. This .bat file and the .pfx are both in the same directory. After I posted this, I uninstalled the x86 install and re-installed the x64 version thinking I should be running the x64 version on my Win7 Prof SP1 machine. Same issue. When I purposedly misspelled the password or even omit it, no errors. Nothing! I don't know what's going on. – sydney Dec 12 '18 at 20:58

Comparing the documentation example and your supplied example code, you're not supplying an encryption password (-e switch).

Without this, the tool cannot encrypt the new private key file with a password, which SQL requires to decrypt it later when creating the certificate. I'm guessing the tool simply doesn't produce the files in this instance. Try adding a password to encrypt the files and see if that helps.

  • I tried it with so many combinations. Had it with just -d; then with -d -e; then omitted both. Even when I just run pvkconveter.exe, pvkconveter.exe /?, pvkconveter.exe -?. Nothing happens. It always puts me back to the DOS prompt. The pre-requisites says I need Visual C++ redistrisbutable. I have pretty much every version installed as well. I don't know what else to look for. – sydney Dec 13 '18 at 13:19
  • Finally got this to work. A couple of issues. 1) I had to shell out to the command prompt "as administrator" 2) had to install "Visual C++ Redistributable for Visual Studio 2012". Here's the weird part. If I run "pvkconverter.exe' with the -d option, it gives me an error saying it requires a decryption password. If omit the "-d" option, it generates the "PVK/DER certificate pairs" which i can see my .cer and .pvk files now. Am I missing anything or is this the expected behavior? I got my files now but not sure if they are legit. – sydney Dec 13 '18 at 19:18
  • I guess the ONLY definitive way to find out if the .cer and .pvk files are valid is to run them on sql server. – sydney Dec 13 '18 at 19:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.