diff --git a/frontend/src/components/dialogs/CertificateUploadDialog.tsx b/frontend/src/components/dialogs/CertificateUploadDialog.tsx
index bad87f0c..18b5e2bc 100644
--- a/frontend/src/components/dialogs/CertificateUploadDialog.tsx
+++ b/frontend/src/components/dialogs/CertificateUploadDialog.tsx
@@ -102,7 +102,8 @@ export default function CertificateUploadDialog({
   }
 
   const canValidate = !!certFile && !validateMutation.isPending
-  const canSubmit = !!certFile && !!name.trim()
+  const needsKeyFile = !!certFile && !isPfx && !keyFile
+  const canSubmit = !!certFile && !!name.trim() && !needsKeyFile
 
   return (
     <Dialog open={open} onOpenChange={handleClose}>
@@ -166,6 +167,12 @@ export default function CertificateUploadDialog({
             </>
           )}
 
+          {needsKeyFile && (
+            <p role="alert" className="text-xs text-red-500">
+              {t('certificates.keyFileRequired')}
+            </p>
+          )}
+
           {certFile && !validationResult && (
             <Button
               type="button"
diff --git a/frontend/src/locales/en/translation.json b/frontend/src/locales/en/translation.json
index 56e5dce0..fe265c90 100644
--- a/frontend/src/locales/en/translation.json
+++ b/frontend/src/locales/en/translation.json
@@ -215,6 +215,7 @@
     "dropFileHere": "Drag and drop a file here, or click to browse",
     "formatDetected": "Detected: {{format}}",
     "pfxDetected": "PFX/PKCS#12 detected — key is embedded, no separate key file needed.",
+    "keyFileRequired": "A private key file is required for PEM/DER certificates.",
     "pfxPassword": "PFX Password (if protected)",
 
     "validate": "Validate",