SSL Toolkit Logo
Tools Features Compare FAQ Login

PEM to Server Config

Upload or paste your PEM certificate and get production-ready SSL configs for Nginx, Apache, Tomcat, HAProxy, Caddy, and IIS.

Server-Specific Tools

— Direct conversion for each server

Nginx

server block

Apache

VirtualHost

HAProxy

frontend

Tomcat

Connector

Caddy

Caddyfile

IIS

web.config

Supported Servers

Ng
Nginx

Server block with SSL, HTTP/2, OCSP, HSTS, redirect.

Ap
Apache

VirtualHost with mod_ssl, cert/key/chain files.

HA
HAProxy

Frontend SSL with combined PEM, ALPN, headers.

Tm
Tomcat

NIO connector, PKCS12 keystore, TLS protocols.

Cd
Caddy

Caddyfile with auto HTTPS and security headers.

IS
IIS

web.config with SSL flags and rewrite rules.

About

The PEM to Server Config tool converts your SSL certificate into production-ready configuration files for the most popular web servers. Paste or upload your PEM certificate (and optional private key/chain), select a Mozilla security profile, and instantly get copy-paste ready configs for Nginx, Apache, HAProxy, Caddy, Tomcat, and IIS.

The tool automatically extracts domain names, SANs, key type, and issuer information from your certificate. It follows the Mozilla Server Side TLS guidelines — the industry standard for server security. Choose between Modern (TLS 1.3 only), Intermediate (TLS 1.2 + 1.3), or Old (legacy) profiles.

How to Use

  1. 1Upload your PEM certificate file or paste the certificate data (including private key and chain if available).
  2. 2Select a security profile: Modern (TLS 1.3), Intermediate (TLS 1.2 + 1.3), or Old (legacy).
  3. 3Toggle features: HSTS header, OCSP stapling, HTTP to HTTPS redirect, and HTTP/2 support.
  4. 4Click Generate Configs and switch between server tabs to view the configuration.
  5. 5Copy the config or download individual files (cert, key, chain, fullchain, and server configs).

Use Cases

✓New server setup — Generate SSL configs when deploying a new Nginx, Apache, or HAProxy server.
✓Server migration — Convert configs when moving from one server type to another (e.g., Apache to Nginx).
✓Security hardening — Apply Mozilla recommended cipher suites and protocol settings.
✓A+ grade configs — Generate configs that pass security audits with an A+ rating.
✓HSTS preload — Generate configs with HSTS headers ready for preload submission.
✓Cross-platform deployment — Get configs for multiple servers from a single certificate.

Tips & Best Practices

  • •Always use the Intermediate profile unless you specifically need legacy client support.
  • •Enable HSTS with a max-age of at least 6 months. Use 2 years for HSTS preload eligibility.
  • •Enable OCSP stapling for faster handshakes and better privacy — your server fetches the OCSP response periodically instead of clients hitting the CA directly.
  • •Always redirect HTTP to HTTPS to prevent downgrade attacks and mixed content issues.
  • •For HAProxy, concatenate cert + key into a single PEM file: cat cert.pem key.pem > combined.pem
  • •For Tomcat, convert PEM to PKCS12: openssl pkcs12 -export -in cert.pem -inkey key.pem -out keystore.p12
  • •After deploying, test with SSL Checker to verify your configuration is working correctly.

Technical Details

Security Profiles (Mozilla Guidelines)

Modern

TLS 1.3 only. Strongest cryptography. No backward compatibility. Requires clients from 2020+.

Intermediate (Recommended)

TLS 1.2 + 1.3. Works with all browsers since 2014. Default for 99% of public websites.

Old

TLS 1.0+. Only for legacy clients like Windows XP IE8 or Android 2.3. Not recommended.

Cipher Suites by Profile

Modern: No cipher config needed (TLS 1.3 handles it). Intermediate: ECDHE+AESGCM, ECDHE+CHACHA20, DHE+AESGCM. Old: Adds AES-CBC for legacy compatibility.

File Outputs

.crt Server certificate, .key Private key, -chain.crt Intermediate certificates, -fullchain.pem Cert + chain combined, .conf Server-specific config file.

Frequently Asked Questions

What is the difference between Modern, Intermediate, and Old profiles?

Modern uses TLS 1.3 only — strongest security but requires recent clients. Intermediate supports TLS 1.2 + 1.3 and works with all browsers since 2014 — this is the recommended choice for most websites. Old includes TLS 1.0/1.1 for legacy clients and is not recommended.

Do I need to include the private key in the PEM?

No. The tool generates server configs that reference file paths for the cert and key. You only need to paste the certificate for config generation. The private key is used for the downloadable key file and fullchain.

What is a chain/intermediate certificate?

The chain certificate (also called intermediate certificate) links your server certificate to the root CA. Browsers need this to build the trust chain. If you paste a fullchain PEM (cert + intermediates), the tool auto-detects and splits them.

Will these configs get an A+ grade?

Yes — the Intermediate profile with HSTS enabled will earn an A+ grade when paired with a valid 2048+ bit certificate. After deploying, test with our SSL Checker to verify your configuration.

What file do I download for HAProxy?

HAProxy requires cert + key in a single PEM file. Download the -fullchain.pem for cert + chain, then concatenate with the key: cat fullchain.pem key.pem > haproxy.pem

Related Tools

SSL Config Generator

Generate configs from domain + paths

SSL Converter

Convert between PEM, DER, P7B, PFX

Config Migration

Migrate configs between servers

SSL Checker

Verify your deployed configuration

Cipher Ranking

Rank cipher suites by security

Format Converter

Convert certificate formats