Key Import/Export

Import and export SSL certificates and keys

About Key Import/Export

Our free Key Import/Export tool converts SSL certificates and keys between PEM, DER, and PKCS12 formats. Supports password-protected private keys and certificate bundles. Essential for certificate format conversion workflows across different server platforms.

How to Use

Select Import or Export mode using the toggle buttons
Paste your certificate or key data in PEM format
Provide a password if importing an encrypted private key
Click the action button to convert and view results

Use Cases

•Converting certificate formats for web server migration
•Extracting private keys from PKCS12 keystores
•Preparing certificates for load balancer and reverse proxy deployment

Frequently Asked Questions

The tool supports PEM, DER, and PKCS12 formats for certificates and private keys. PEM is the most common format used by Apache and Nginx servers, while PKCS12 is often used by Windows and Java environments.

A password is only required if the key or PFX/PKCS12 file you are importing was encrypted with a passphrase. Unencrypted PEM files do not require a password for import.

PEM is a Base64-encoded format with header and footer lines that is human-readable and widely used by web servers. DER is a binary format that is more compact and commonly used in Java and Windows environments.

PEM private keys — plain or password-encrypted — PEM certificates, and base64-encoded DER certificates. The importer sniffs the header first, so it routes each input to the right parser instead of forcing one. A DER certificate additionally comes back converted to PEM, which is convenient when a Windows-issued blob needs to go onto an nginx or Apache server that expects PEM text.

Supply it in the password field and the importer unlocks the key before reporting on it. Without the correct password an encrypted key is indistinguishable from corrupt data, so a wrong or missing password yields a parse failure rather than partial information. Unencrypted keys ignore the field entirely, and the password is used only for that single parse attempt.

The result names the key type and size from the parsed object — RSA with 2048 bits, for example — plus the detected format and a human-readable detail line. A failed import says so explicitly and names the problem. If the reported type or size does not match what you believe you pasted, you pasted the wrong file, and finding that out here is the entire point.

Yes, through the paired export step: once PEM validates, it can be rendered into the other formats the export endpoint produces. The common direction is DER to PEM, handled inline during import, and PEM outward to whatever your target server consumes. Conversion re-encodes the same key material rather than reissuing anything, so the certificate and its trust properties are unchanged.

For test and expired keys, yes — the text is parsed in your session and only the description comes back. For live production keys, the safer habit is local tooling: the openssl and Python equivalents are one-liners and the key never leaves your machine. Never paste a production key into any site you do not operate, and rotate anything you suspect has been exposed regardless of where.

How the Import Works

Paste key material and this page parses it cryptographically, reporting what it found — key type, size and format — or a plain rejection when the text is not parseable. A sibling export endpoint converts validated PEM into other formats.

1Paste PEM text. Private keys are loaded directly — encrypted ones with the password you supply — and reported with their algorithm name and bit size read from the parsed object.
2Or paste a certificate, which is parsed for its subject common name and public-key size. Base64 DER blobs are recognised too: a DER certificate is decoded, identified, and converted back to PEM for you.
3Read the verdict. Anything unparseable — a CSR, truncated text, random pastes — returns an explicit failure naming the format problem instead of a guessed answer.

Key sizes here come from the parsed objects, the same honest reporting as the checksum page. And the usual caution applies: paste test material freely, but production private keys belong in as few places as possible — prefer local tooling for those.

Tips & Best Practices

•Export keys securely for backup and migration purposes
•Import keys using the correct format for your target system
•Protect exported keys with strong passwords
•Verify imported keys work correctly before deploying to production

Technical Details

Formats: PEM, DER, PKCS#8, PKCS#12 key format handling
Operations: Key import, export, and format conversion
Security: Password-protected key handling
Output: Converted key files with format validation

Related Tools

SSL Certificate Checker Key Checksum Validator RSA Key Strength Analyzer Nginx Config Validator Let's Encrypt Auto-Issuer PCI DSS Compliance Checker