Certificate Format Converter

About Certificate Formats

SSL/TLS certificates come in several standard formats: PEM (Base64-encoded, most common), DER (binary format), PKCS12 (archive format for bundling certificates and private keys), and PKCS7 (signed data format). Our Format Converter enables quick conversion between these formats without needing OpenSSL command-line tools, making certificate management accessible to everyone.

How to Use

Select the conversion type from the mode buttons (e.g., PEM to DER).
Paste your certificate data into the input text area shown.
Optionally enter a password for PKCS12-related conversions.
Click Convert to transform the certificate and copy the output.

Use Cases

Server Deployment: Convert certificates to the format required by your web server or application.
Legacy System Migration: Convert DER certificates to PEM for compatibility with modern tools.
Certificate Bundling: Package certificates and private keys into PKCS12 for easy distribution.
Platform Compatibility: Convert between formats when moving certificates between Windows, Linux, and macOS systems.

Frequently Asked Questions

PEM is a Base64-encoded text format with header and footer lines (e.g., -----BEGIN CERTIFICATE-----), making it human-readable and easy to copy. DER is the binary encoding of the certificate in ASN.1 format. PEM is more commonly used for web servers while DER is used on some platforms like Java and Windows.

This tool converts certificate files between formats, not private keys. For private key conversion, use OpenSSL command-line tools. PKCS12 conversion handles both certificates and private keys together when you provide the correct password.

PKCS7 (also called P7B) is a format used for certificate chains and signed data. It usually contains only certificates (no private keys) and is commonly used by Microsoft Windows and Java for certificate distribution. It is Base64-encoded with -----BEGIN PKCS7----- headers.

No. PEM and DER are two encodings of the same bytes, so a certificate converted between them parses to an identical structure with the same serial, the same validity dates and the same fingerprint. That is the quickest way to prove a conversion was clean: if the SHA-256 fingerprint from the original matches the one from the converted file, nothing was altered in the process. What conversion does change is which tools will accept the file.

Because PEM adds base64 encoding and the begin and end markers, which together cost roughly a third more space than the binary. A DER certificate that is 1,200 bytes becomes roughly 1,600 in PEM. That ratio is expected and not a sign of corruption. If the difference is larger, check that only one certificate ended up in the file — multiple certificates concatenated into one PEM are normal for a chain and easy to create by accident.

Whatever the error message asks for. “Unable to load certificate” with a note about a PEM file means the server wants DER; “invalid format” on a binary file usually means the reverse. The conversion is lossless either way, so there is no risk in trying. If the tool will not accept the result, the problem is elsewhere — most often a certificate that has expired, or a file that actually contains a key rather than a certificate.

Concatenate them into one PEM file with the leaf first, then each intermediate in order, then the root if you have it. Order matters: the reader expects each certificate to be issued by the one after it. Convert to PKCS#7 or P7B instead if the receiving software expects a container rather than a plain concatenation, which several Windows and Java components do. The Chain Validator will confirm whether what you have assembled actually builds a valid path.

Because a key is a different kind of object and deserves a different tool. Private keys need handling that considers password protection, key type and encoding format, and getting that wrong tends to produce a key that appears to work and then fails on the server. The PFX to PEM tool handles keys properly, including splitting a container into a certificate and a key and telling you when they do not match. Use it for anything involving key material.

Why the Formats Exist

A certificate is a binary document. Every format below is a different way of wrapping the same bytes so that a particular piece of software can accept them.

PEM

Base64 text between BEGIN and END CERTIFICATE lines. It is about a third larger than the binary and is what you can paste into a config file, read in an email and copy through a ticket. Nginx, Apache and most documentation expect it.

DER

The same certificate as raw binary, with no armour. Smaller, and what certificate authorities hand out as the “binary” download and what Windows certificate stores and Java key stores use internally.

PKCS#7 / P7B

A container for a certificate and the intermediates needed to build a chain, without the private key. It is the format to use when you have several certificates to distribute together, such as handing an intermediate to an application that expects a bundle.

PFX / P12

A password-protected container that can hold the private key as well. If your task involves a private key, use the PFX to PEM tool instead — this page does not handle keys.

Converting between PEM and DER changes only the encoding. The certificate inside is byte-for-byte the same document, and its fingerprint is unchanged, which is the quickest way to confirm a conversion was lossless.

Technical Details

Formats: PEM, DER, P7B/PKCS#7, PFX/PKCS#12 conversion
Components: Certificate, key, and chain conversion
Security: Password-protected format handling
Output: Converted certificate files with validation