convert p7b to pfx for Azure

I've spent many hours on this today and finally got it to work! Putting it out here to save someone from this waste of time. (I don't understand why Azure only accepts pfx and why dns companies do not provide this file to save their customers from this, but here we are, caught in the middle).

My instructions are for GoDaddy and Windows 10.

It should work with other providers, but if you are not on Windows, the last set of instructions won't work as they need a Windows MMC...

Prerequisites:

1. When creating SSL certificate with your provider, save private key into a file (e.g. generated-private-key.txt). If you don't have the private key, this will not work!
2. Download crt/pem certificates from provider (from GoDaddy you get three files in a zip: .crt, .pem and .p7b). I think you only really need crt, but at this time I am not changing anything! You can try to omit pem later. There is a way to get these from p7b using openSSL (see the end of instructions), but you are better off getting them from your SSL provider, these are normally supplied, unlike pfx.
3. You will need openSSL tool which you can download for Windows from here. There's probably other ways to get it, this worked for me in June 2022.

TL;DR

Use openSSL to convert to pfx. This alone does not work because the cert does not contain exportable private key. So I use certlm mmc to include the key in the second cert.

Detailed Instructions

1. Convert your certificate to pfx format using openSSL

openssl pkcs12 -export -out certificate.pfx -inkey generated-private-key.txt -in goDaddy.crt -certfile goDaddy.pem

You will be asked to provide a password, do not leave it blank. This cert does not contain private key which is why you need to do it all again with MMC. Maybe there is a way to tell openSSL to do it, but I have no fight left in me at this point.

2. Start Certificates MMC on Windows (certlm)

Type certlm in Windows command

3. Import pfx certificate

In certlm, right-click on personal, and choose import from the menu

Go through the wizard, making sure you select the pfx file created in step 1. Make sure you select make key exportable, include extended properties, and provide the password you specified in step 1. Place the cert in personal.

4. Export the certificate to pfx with the private key

Right click on the personal certificate you imported in step 3, and choose export from the menu. Make sure you select the option to include the private key. This is important. If this option is not there, it won't work.

In the next step in the wizard select option as per below image.

Finally select triple DES encryption and provide the password (can be the same as the one you used in step 1). Did not work for me with AES encryption, but that may change in future. If one encryption does not work, try the other one. At the time of writing DES was working (June 2022).

5. Import into Azure

Go to Azure Portal and import the certificate you exported in step 4 (not the initial one from step 1).

Optional If you did not get crt file from provider, you can extract it from the p7b file with this command:

openssl pkcs7 -print_certs -in goDaddy.p7b -out certificate.crt

An easier way is to go to https://decoder.link/converter

1. Upload the .crt issued by your ssl provider
2. Upload the private key .txt file you downloaded from your ssl provider
3. Upload the .ca-bundle issued by your ssl provider
4. Set a password you can remember
5. Click submit and when you get the "successfully converted" message, click Download.

Now you have the .pfx file to upload into Azure or your cloud hosting.