SSL Tool

SSL Converter

Convert SSL certificates between PEM, DER, P7B and PFX formats. Paste your certificate, select the conversion and download the result.

💻 OpenSSL Commands for Other Formats

PEM → DER

openssl x509 -outform der -in certificate.pem -out certificate.der

DER → PEM

openssl x509 -inform der -in certificate.der -out certificate.pem

PEM → P7B

openssl crl2pkcs7 -nocrl -certfile certificate.pem -out certificate.p7b

P7B → PEM

openssl pkcs7 -print_certs -in certificate.p7b -out certificate.pem

PEM → PFX

openssl pkcs12 -export -out certificate.pfx -inkey private.key -in certificate.pem -certfile ca-bundle.pem

PFX → PEM

openssl pkcs12 -in certificate.pfx -out certificate.pem -nodes

Frequently Asked Questions

What SSL certificate formats can I convert between?

The SSL Converter supports conversion between PEM (.pem, .crt, .cer), DER (.der, .cer), PKCS#7 (.p7b, .p7c), and PKCS#12 (.pfx, .p12) formats. Different web servers require different formats — Apache and Nginx use PEM, Windows servers use PFX, and Java applications typically use PKCS#12.

What is the difference between PEM and DER format?

PEM is a Base64-encoded text format with header and footer lines (BEGIN CERTIFICATE / END CERTIFICATE). DER is the binary encoding of the same certificate data. PEM is human-readable and the most widely used format on Linux-based web servers.

Do I need my private key to convert a certificate format?

For converting from PKCS#12 (PFX) format, you will need the password set when the PFX was created since PFX bundles the certificate and private key together. For converting between PEM, DER, and PKCS#7 formats, only the certificate file is needed.

What is the difference between PEM and DER?

PEM (Privacy Enhanced Mail) is base64-encoded and human-readable, starting with -----BEGIN CERTIFICATE-----. DER (Distinguished Encoding Rules) is the binary version of the same certificate. Most web servers use PEM format.

What is a P7B file?

P7B (PKCS#7) files contain one or more certificates but not the private key. They are commonly used on Windows servers and Java applications. The certificate is base64-encoded and starts with -----BEGIN PKCS7-----.

What is a PFX file?

PFX (PKCS#12) is a binary format that bundles the certificate, any intermediate certificates and the private key into a single password-protected file. Commonly used on Windows IIS and for importing/exporting certificates.

Certificate formats explained

Certificates and keys come in several file formats, and different servers expect different ones. The content is the same; only the encoding and packaging change.

PEM (.pem, .crt, .cer, .key): Base64 text between BEGIN and END lines. Used by Apache, Nginx and most Linux software.
DER (.der, .cer): the same data in binary form, common with Java and some Windows tools.
PKCS#7 or P7B (.p7b, .p7c): holds the certificate and its chain, but never a private key. Used by Windows and Tomcat.
PKCS#12 or PFX (.pfx, .p12): a password-protected bundle of the certificate, chain and private key in one file. Used by IIS, Windows and many network appliances.

A .cer file can be either PEM or DER. Open it in a text editor: if you see a BEGIN CERTIFICATE line, it is PEM.

Which format do I need?

Apache and Nginx: PEM files for the certificate (with its chain) and the key.
IIS and Windows: PFX.
Tomcat and other Java servers: a keystore, usually built from a PFX file.
Load balancers and CDNs: usually PEM text pasted into a form.

Handling private keys

Converting to or from PFX involves the private key. For production certificates you can do the same conversion locally, for example openssl pkcs12 -export -out site.pfx -inkey site.key -in site.crt -certfile chain.crt, so the key never leaves your machine. Always protect PFX files with a strong password.