SSL Converter

Current Format

Convert To

Certificate File

Or paste certificate data

About Certificate Formats

PEM

PEM Format — Privacy Enhanced Mail

The PEM format is the most common format that Certificate Authorities issue certificates in. It is Base64-encoded ASCII with -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- header/footer lines.

Used by: Apache, Nginx, HAProxy, cPanel, most Linux/Unix based web servers. PEM files can contain the server certificate, intermediate certificates, and the private key — though most platforms (like Apache) expect them in separate files.

File extensions: .pem, .crt, .cer, .key

DER

DER Format — Distinguished Encoding Rules

A binary form of a certificate instead of the ASCII PEM format. DER files are not human-readable in a text editor. All types of certificates and private keys can be encoded in DER format.

Used by: Java platforms (Java KeyStore, Tomcat), some embedded devices. DER files often have a .cer extension — the only way to distinguish them from PEM .cer files is to open them in a text editor and check for the BEGIN/END lines.

File extensions: .der, .cer

P7B

PKCS#7 / P7B Format — Cryptographic Message Syntax

Stored in Base64 ASCII format with -----BEGIN PKCS7----- header. P7B files contain only certificates and chain certificates — they do not include the private key.

Used by: Microsoft Windows (Certificate Export Wizard), Java Tomcat, IIS. P7B is the format used by Windows when exporting certificates with their chain.

File extensions: .p7b, .p7c

PFX

PKCS#12 / PFX Format — Personal Information Exchange

A binary format that bundles the server certificate, any intermediate (chain) certificates, and the private key into a single encrypted file. PFX files are password-protected to secure the private key.

Used by: Microsoft Windows IIS, Windows Certificate Import Wizard, macOS Keychain, VMware. When converting PFX to PEM, OpenSSL extracts all certificates and the private key into one file — you typically need to split them into separate files for Apache/Nginx.

File extensions: .pfx, .p12

OpenSSL Commands

For maximum security, convert certificates on your own machine using the OpenSSL commands below:

PEM → DER: openssl x509 -outform der -in cert.pem -out cert.der

DER → PEM: openssl x509 -inform der -in cert.cer -out cert.pem

PEM → P7B: openssl crl2pkcs7 -nocrl -certfile cert.pem -out cert.p7b -certfile chain.pem

P7B → PEM: openssl pkcs7 -print_certs -in cert.p7b -out cert.pem

PEM → PFX: openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert.pem -certfile chain.pem

PFX → PEM: openssl pkcs12 -in cert.pfx -out cert.pem -nodes

PFX → PEM (split): openssl pkcs12 -in cert.pfx -nokeys -out cert.pem && openssl pkcs12 -in cert.pfx -nocerts -nodes -out key.pem

P7B → PFX: openssl pkcs7 -print_certs -in cert.p7b -out cert.pem && openssl pkcs12 -export -in cert.pem -inkey key.pem -out cert.pfx

⚠

Security Note

Your private key is processed server-side during conversion to provide instant results. It is never stored, logged, or cached. However, for production or sensitive keys, we strongly recommend using the OpenSSL commands above to convert certificates locally on your own machine.

How to Use

1Select the source certificate format (PEM, DER, P7B, or PFX)
2Select the target format you want to convert to
3Upload your certificate file or paste the certificate data
4If converting to PFX, provide the private key and optional chain certificates
5Click Convert and download the converted certificate

Use Cases

•Server Migration: Convert certificates when moving between web servers (e.g., Apache PEM to Nginx PEM, or to Tomcat PFX)
•Java Keystore Import: Convert PEM certificates to PFX/PKCS#12 for import into Java KeyStore or Tomcat
•Certificate Bundling: Combine server certificate with intermediate chain into a single P7B file for Windows/IIS
•Binary Conversion: Convert human-readable PEM to binary DER for embedded systems and hardware security modules
•Key Extraction: Extract private keys from PFX files for use in separate configuration files

Frequently Asked Questions

PEM is a Base64-encoded ASCII format with header and footer lines, making it human-readable and easy to copy. DER is a binary format that is not human-readable. PEM is more commonly used on web servers, while DER is often used in Java environments and embedded devices.

You only need a private key when converting to PFX/PKCS#12 format, which bundles the certificate with its private key. For conversions between PEM, DER, and P7B, only the certificate data is required — the private key is not needed.

Your private key is processed server-side only long enough to perform the conversion. It is never stored, logged, or cached. However, for maximum security with production or sensitive keys, we recommend using the included OpenSSL commands to convert certificates locally on your own machine.

No. The signature covers the certificate's content, not its encoding, so a converted certificate is byte-for-byte equivalent in meaning and validates identically. What does change is representation, which is why conversion is safe — and why it cannot fix anything substantive. An expired certificate converts to an equally expired one, since expiry is a fact about the content.

DER to PEM, in practice. Windows services and some appliances want DER or PKCS#12 while web servers almost universally want PEM, and migrating from one platform to another generally means converting in that direction. PEM to DER is rarer, usually because a tool produced something odd. Either way, verify the output before deploying it rather than assuming the conversion did what you wanted.

Keys are converted separately from certificates, and a key cannot be converted into a certificate or the reverse. Converting a key between encodings is supported where the target format allows it, but keys should stay out of websites entirely as a matter of habit. The pages here handle key material for the cases where you have no alternative, and local tooling is preferable wherever it is available.

Usually because it is not one certificate. A PEM chain holding several certificates separated by blank lines is a bundle and converts as such; a private key or CSR pasted into a certificate field is correctly rejected. The error names what was found, which is more informative than a generic failure — read it before concluding the file is damaged.

Essentially none to the certificate itself, since conversion preserves its content. The risk is operational: overwriting the only copy of a file you were relying on, or deploying a conversion without checking it. Keep the original, compare subject and fingerprint before and after, and treat the converted file as a new artefact until it has been verified in place.

What Conversion Does

Certificates and keys exist in several encodings because different systems expect different ones. This page converts between them and is explicit about what it cannot do.

1Identify the input format from its content rather than trusting a label or filename, so a mislabelled or wrongly named file still converts correctly. Guessing from the extension is how conversion silently produces the wrong thing.
2Parse into a canonical form and re-encode to the requested output. Going through a parsed intermediate is what makes the result faithful — the same certificates, not a reinterpretation of the bytes.
3Report failures explicitly rather than producing an empty result. A conversion that yields nothing and looks successful is worse than an error, because you find out at deployment.

Conversion is re-encoding. Validity, issuer and trust properties are unchanged, so a converted certificate validates exactly as the original did — and conversion cannot repair an expired or wrong-name certificate, since neither is a property of the encoding.

Technical Details

Formats: PEM, DER, P7B, PFX certificate conversion
Components: Certificate, key, and chain conversion
Security: Password-protected format handling
Output: Converted certificate files with validation