---
title: "Issue a PKCS #12 file"
description: "How to have Amplia generate the key pair and return the certificate in a password-protected PKCS #12 (.pfx) file, or the key and certificate in several formats."
canonical: "https://docs.lacunasoftware.com/en-us/articles/amplia/integration/pkcs12"
locale: "en"
product: "Amplia"
last_updated: "2026-10-12"
---

# Issue a PKCS #12 file

When your system has no key of its own to send, [Amplia](https://docs.lacunasoftware.com/en-us/articles/amplia) can make the key pair, issue the certificate and return both in a
password-protected PKCS #12 (.pfx) file. This API exists since Amplia 4.1.0. 

## Flow

1. [Create the order](https://docs.lacunasoftware.com/en-us/articles/amplia/integration/orders).
1. Call `POST /api/certificates/pkcs12` with the order's id, the password for the file and the key size.
1. Store the file from the response's `pfxContent` (Base64); the response's `model` describes the issued certificate.

The only sample is in Node.js. It asks for a 2048-bit key, with the password the user typed: 

```js
let order = await client.createOrder(request);
let cert = await client.issuePkcs12Certificate(order.getId(), req.body.senha, 2048);
let certId = cert.getModel().id;
StorageMock.storeSync(cert.getPfxContent(), certId, '.pfx');
```

| Field | Meaning |
|---|---|
| `orderId` | Id of the order to fulfill. |
| `password` | Password that protects the PKCS #12 file. |
| `keySize` | Size of the key pair, in bits; the sample uses 2048. |

* Only the Node.js client has this call. Its `getPfxContent()` returns `pfxContent` as the API sends it, in Base64, and `getModel()`
  returns the certificate's JSON as is. 
* TODO(docs): which key sizes are accepted, and whether Amplia keeps a copy of the private key after returning the file.
* The private key reaches your server inside the file: protect the file and its password as you would the key itself.

## Key and certificate in other formats

Since Amplia 4.7.0, `POST /api/certificates/software` takes the same request and returns the key and the certificate in several formats:
`pkcs12Der`, `certificateDer` and `certificatePem`, `publicKeyDer` and `publicKeyPem`, `privateKeyPkcs8Der` and `privateKeyPkcs8Pem`,
`privateKeyPkcs1Der` and `privateKeyPkcs1Pem`, plus the certificate's `model`. 
The Node.js client's `issueSoftwareCertificate(orderId, password, keySize)` calls it, with a 2048-bit key by default. 

## See also

* [Create certificate orders](https://docs.lacunasoftware.com/en-us/articles/amplia/integration/orders)
* [Issue from a CSR](https://docs.lacunasoftware.com/en-us/articles/amplia/integration/issue-from-csr), to keep the key where it was made
* [Errors](https://docs.lacunasoftware.com/en-us/articles/amplia/integration/errors)

**Demos and samples**

- Issue a PKCS #12 certificate using Amplia: [Node.js](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/nodejs/expressmvc/routes/issue-pkcs12-cert-server-amplia.js)