Upload a password-protected archive, choose how the extracted key should be protected, and decide whether you want just the leaf certificate or the full chain. The tool runs openssl with strict, auditable flags and destroys every workspace after download.