diff --git a/src/lib/provisioner.ts b/src/lib/provisioner.ts
index 9d36d44..59e5f4a 100644
--- a/src/lib/provisioner.ts
+++ b/src/lib/provisioner.ts
@@ -157,7 +157,9 @@ export class Provisioner {
     if (currentFormat === 'pem') {
       const bundle = parsePemBundle(secretValue);
       this.log(`[convert] parsed blocks — key: ${bundle.privateKeyPem.length} chars, cert: ${bundle.certPem.length} chars, chain: ${bundle.chainPem.length} chars`);
-      await this.store.importCertificate(certName, pemToPfx(bundle.privateKeyPem, bundle.certPem, bundle.chainPem), 'pfx');
+      const pfxBuffer = pemToPfx(bundle.privateKeyPem, bundle.certPem, bundle.chainPem);
+      this.log(`[convert] PFX buffer size: ${pfxBuffer.length} bytes`);
+      await this.store.importCertificate(certName, pfxBuffer, 'pfx');
     } else {
       const bundle = pfxToPem(Buffer.from(secretValue, 'base64'));
       this.log(`[convert] parsed PFX — key: ${bundle.privateKeyPem.length} chars, cert: ${bundle.certPem.length} chars, chain: ${bundle.chainPem.length} chars`);