Convert certificates between PEM, DER, and PKCS#12.
Runs against a live TLS connection or the certificate you paste in — nothing here is stored or sent anywhere else.
The certificate never changes. Only the container does — and every server, appliance, and language runtime has an opinion about which container it will accept.
.pem, .crt, .cer) — base64 text between BEGIN and END lines. What nginx, Apache, and most Unix tooling expect..der, sometimes .cer) — the same certificate as raw binary. Common in Java tooling and on network appliances..pfx, .p12) — an encrypted archive holding the certificate and its private key together. What IIS, Windows, and Java keystores want.Note that .cer can be either PEM or DER. The extension is not reliable; the contents are. If the first line reads -----BEGIN CERTIFICATE----- it is PEM, and if it looks like binary noise it is DER.
PEM to DER. Takes a PEM certificate and returns the binary form, for a tool that will not accept text.
DER to PEM. Takes base64-encoded DER and returns a PEM block you can paste into a config file or into the Cert Decoder.
PEM to PKCS#12. Takes a certificate plus its matching private key and a passphrase, and returns a .pfx ready to import into IIS or a Java keystore.
PKCS#12 to PEM. Takes a .pfx and its passphrase and returns the certificate and private key as separate PEM blocks, which is what you need when moving a certificate off Windows and onto nginx.
Every conversion here has a local equivalent. For a production private key, running these on the machine that holds it is the more careful path:
# PEM to DER
openssl x509 -in certificate.pem -outform der -out certificate.der
# DER to PEM
openssl x509 -in certificate.der -inform der -out certificate.pem
# PEM certificate and key to PKCS#12
openssl pkcs12 -export -out certificate.pfx \
-inkey private.key -in certificate.crt
# PKCS#12 back to PEM
openssl pkcs12 -in certificate.pfx -out certificate.pem -nodes"Not a valid PEM certificate." The input is probably DER, a private key, or a CSR rather than a certificate. Check the first line.
"Not valid base64-encoded DER data." Binary content pasted directly into a text field rarely survives. Base64-encode the file first: base64 certificate.der.
"Could not bundle this certificate and key." The key does not match the certificate. Confirm the pairing by comparing the two moduli — matching output means they belong together:
openssl x509 -noout -modulus -in certificate.crt | openssl md5
openssl rsa -noout -modulus -in private.key | openssl md5"Could not open this PKCS#12 bundle." Wrong passphrase, or the file is not actually PKCS#12.
You convert a certificate once, during installation. Then it sits there quietly until the day it expires and takes something down with it.
Renew Radar watches the certificates you have already installed and warns you before that day arrives. Free while in beta for up to 20 certificates.
They hold the same X.509 certificate. DER is the raw binary encoding; PEM is that same binary base64-encoded and wrapped in BEGIN and END lines so it can be pasted into a text file. Converting between them changes the packaging, never the certificate.
A single password-protected archive holding a certificate and its private key together, and often the intermediates too. Windows, IIS, Java keystores, and many appliances want a certificate delivered this way rather than as separate PEM files.
Effectively yes. Both are PKCS#12 archives; the extensions are a historical split between Microsoft tooling and everything else. Rename the file if a tool insists on one or the other.
Almost always because the private key does not match the certificate. A key and certificate are a mathematical pair, and a key from an earlier CSR will not bundle with a certificate issued against a later one. Check that you are using the key generated alongside the CSR you actually submitted.
Yes. A PKCS#12 archive is encrypted, and whatever server or keystore imports it will ask for the same passphrase. Store it with the file.
No. Conversions run for the duration of the request and the result is returned to you. Nothing is written to a database, and the passphrase is cleared once the conversion finishes. For a production key, running the equivalent OpenSSL command locally is still the more cautious choice.