SSL Converter

Convert certificates between PEM, DER, P7B/PKCS#7, and PFX/PKCS#12 formats. Upload your files or paste the data below.

Current Format

Convert To

Certificate File

Or paste certificate data

About Certificate Formats

PEM

PEM Format — Privacy Enhanced Mail

The PEM format is the most common format that Certificate Authorities issue certificates in. It is Base64-encoded ASCII with -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- header/footer lines.

Used by: Apache, Nginx, HAProxy, cPanel, most Linux/Unix based web servers. PEM files can contain the server certificate, intermediate certificates, and the private key — though most platforms (like Apache) expect them in separate files.

File extensions: .pem, .crt, .cer, .key

DER

DER Format — Distinguished Encoding Rules

A binary form of a certificate instead of the ASCII PEM format. DER files are not human-readable in a text editor. All types of certificates and private keys can be encoded in DER format.

Used by: Java platforms (Java KeyStore, Tomcat), some embedded devices. DER files often have a .cer extension — the only way to distinguish them from PEM .cer files is to open them in a text editor and check for the BEGIN/END lines.

File extensions: .der, .cer

P7B

PKCS#7 / P7B Format — Cryptographic Message Syntax

Stored in Base64 ASCII format with -----BEGIN PKCS7----- header. P7B files contain only certificates and chain certificates — they do not include the private key.

Used by: Microsoft Windows (Certificate Export Wizard), Java Tomcat, IIS. P7B is the format used by Windows when exporting certificates with their chain.

File extensions: .p7b, .p7c

PFX

PKCS#12 / PFX Format — Personal Information Exchange

A binary format that bundles the server certificate, any intermediate (chain) certificates, and the private key into a single encrypted file. PFX files are password-protected to secure the private key.

Used by: Microsoft Windows IIS, Windows Certificate Import Wizard, macOS Keychain, VMware. When converting PFX to PEM, OpenSSL extracts all certificates and the private key into one file — you typically need to split them into separate files for Apache/Nginx.

File extensions: .pfx, .p12

OpenSSL Commands

For maximum security, convert certificates on your own machine using the OpenSSL commands below:

PEM → DER: openssl x509 -outform der -in cert.pem -out cert.der

DER → PEM: openssl x509 -inform der -in cert.cer -out cert.pem

PEM → P7B: openssl crl2pkcs7 -nocrl -certfile cert.pem -out cert.p7b -certfile chain.pem

P7B → PEM: openssl pkcs7 -print_certs -in cert.p7b -out cert.pem

PEM → PFX: openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert.pem -certfile chain.pem

PFX → PEM: openssl pkcs12 -in cert.pfx -out cert.pem -nodes

PFX → PEM (split): openssl pkcs12 -in cert.pfx -nokeys -out cert.pem && openssl pkcs12 -in cert.pfx -nocerts -nodes -out key.pem

P7B → PFX: openssl pkcs7 -print_certs -in cert.p7b -out cert.pem && openssl pkcs12 -export -in cert.pem -inkey key.pem -out cert.pfx

⚠

Security Note

Your private key is processed server-side during conversion to provide instant results. It is never stored, logged, or cached. However, for production or sensitive keys, we strongly recommend using the OpenSSL commands above to convert certificates locally on your own machine.

How to Use

1Select the source certificate format (PEM, DER, P7B, or PFX)
2Select the target format you want to convert to
3Upload your certificate file or paste the certificate data
4If converting to PFX, provide the private key and optional chain certificates
5Click Convert and download the converted certificate

Use Cases

•Server Migration: Convert certificates when moving between web servers (e.g., Apache PEM to Nginx PEM, or to Tomcat PFX)
•Java Keystore Import: Convert PEM certificates to PFX/PKCS#12 for import into Java KeyStore or Tomcat
•Certificate Bundling: Combine server certificate with intermediate chain into a single P7B file for Windows/IIS
•Binary Conversion: Convert human-readable PEM to binary DER for embedded systems and hardware security modules
•Key Extraction: Extract private keys from PFX files for use in separate configuration files

Frequently Asked Questions

PEM is a Base64-encoded ASCII format with header and footer lines, making it human-readable and easy to copy. DER is a binary format that is not human-readable. PEM is more commonly used on web servers, while DER is often used in Java environments and embedded devices.

You only need a private key when converting to PFX/PKCS#12 format, which bundles the certificate with its private key. For conversions between PEM, DER, and P7B, only the certificate data is required — the private key is not needed.

Your private key is processed server-side only long enough to perform the conversion. It is never stored, logged, or cached. However, for maximum security with production or sensitive keys, we recommend using the included OpenSSL commands to convert certificates locally on your own machine.

Tips & Best Practices

•Convert certificates to the format required by your target server
•Verify converted certificates load correctly before deployment
•Keep original certificate files as backups after conversion
•Understand format differences when converting between PEM, DER, PFX

Technical Details

Formats: PEM, DER, P7B, PFX certificate conversion
Components: Certificate, key, and chain conversion
Security: Password-protected format handling
Output: Converted certificate files with validation