IIS 4 certificate files usually contain both the private key and public certificate for SSL. To convert these to RSA private key and x.509 public certificates from NET to DER format, you need to manually edit the binary key file as documented on Thawte's site <http://www.thawte.com/html/SUPPORT/server/msiis4.html> then run the following OpenSSL commands

The following script filters a given input directory of IIS format log files and outputs the filtered results into the specified path. Log files typically have the name formated as exYYMMDD.log.

This script will append an extension to the end of the given files, optionally removing any existing extensions. Don't ask me why I wrote this, must have been important at one point in time. A lot easier to do this via find in un*x.