How is the pfx certificate different from cert certificate?
The certificate is, nominally, a container for the public key. It includes the public key, the server name, some extra information about the server, and a signature computed by a certification authority (CA). When the server sends its public key to a client, it actually sends its certificate, with a few other certificates (the certificate which contains the public key of the CA which signed its certificate, and the certificate for the CA which signed the CA's certificate, and so on). Certificates are intrinsically public objects.
Some people use the term "certificate" to designate both the certificate and the private key; this is a common source of confusion. I personally stick to the strict definition for which the certificate is the signed container for the public key only.
A pfx certificate is a PKCS#12 archive: a bag which can contain a lot of objects with optional password protection; but, usually, a PKCS#12 archive contains a certificate (possibly with its assorted set of CA certificates) and the corresponding private key.
On the other hand, a .cert (or .cer or .crt) file usually contains a single certificate, alone and without any wrapping (no private key, no password protection, just the certificate).
Answer (1)
The main difference is that .pfx and .crt/.cer files serve different purposes in SSL/TLS certificate management. A .pfx file is typically a container that can hold a certificate plus its private key and certificate chain, while a .crt or .cer file usually contains only the public certificate.
A PFX file, also known as PKCS#12, is commonly used when you need to move or install an entire certificate identity from one server or system to another. Because it can contain the private key, it is normally protected with a password. For example, when exporting an SSL certificate from Windows/IIS, you may receive a .pfx file containing the server certificate and its corresponding private key. The private key is what allows the server to prove that it owns the certificate.
A CRT or CER file, on the other hand, normally contains the public certificate. The certificate includes information such as the domain name, the certificate authority that issued it, the validity period, the public key, and the digital signature from the CA. It does not normally contain the private key. Depending on the encoding, a .crt or .cer file can be encoded as DER or Base64/PEM, so the extension alone does not tell you the exact encoding.
For example, if you receive a certificate from a certificate authority, you might have a file such as example.crt. That certificate can be installed on a web server, but the server also needs access to the corresponding private key to establish HTTPS connections. If the private key was generated separately, you may have something like example.key. In contrast, a PFX file can package the certificate and private key together.
Conceptually, you can think of a certificate as the public identity document, while the private key is the secret credential used to prove ownership of that identity. A PFX file is a secure package that can carry both pieces together.
For example, a PFX file might contain a structure similar to:
PFX / PKCS#12
├── Server Certificate
├── Private Key
└── Intermediate Certificate(s)
A typical CRT file would contain something closer to:
Certificate
├── Domain / Subject
├── Public Key
├── Issuer
├── Valid From / Valid To
└── CA Signature
This difference becomes particularly important when configuring HTTPS. On Windows/IIS, PFX files are commonly convenient because IIS can import the certificate and private key together. On many Linux web servers, such as Nginx or Apache, certificates and private keys are commonly configured as separate files, for example a .crt/.pem certificate and a .key private key.
Another important distinction is security. A .crt file generally isn't considered secret because it contains public information. A .pfx file, however, can contain the private key. You should therefore protect a PFX file carefully and never publish it in a public repository or send it through an insecure channel. If someone obtains the private key and can use it appropriately, they may be able to impersonate the certificate's identity.
The certificate chain is another reason PFX files can be useful. A PFX package can include the server certificate, private key, and intermediate certificates required to establish a trusted chain. A simple CRT file may contain only the individual server certificate, although separate CA/intermediate certificate files can be supplied when configuring the server.
It's also worth noting that .pfx, .p12, .crt, .cer, and .pem describe different things to varying degrees. .pfx and .p12 generally indicate a PKCS#12 container, whereas .crt and .cer are commonly certificate-file extensions. .pem describes a text-based encoding/container format that can hold certificates, private keys, or certificate chains. Therefore, you shouldn't determine the actual contents of a file solely from its extension.
In short, if you only need to distribute a public certificate, a CRT/CER file is generally sufficient. If you need to transfer a certificate together with its private key, a password-protected PFX/PKCS#12 file is usually the appropriate format. The exact format you should use ultimately depends on the server software and certificate-management system you're configuring.