SSL Converter
Convert your SSL certificate to various formats
Got your SSL certificate but your server won’t accept it? The most common reason is a format mismatch.
Certificate authorities typically issue certificates in PEM format, but Windows IIS requires PFX, Tomcat needs DER or P7B, and some platforms have their own requirements entirely. Rather than wrestle with OpenSSL commands, use our free SSL Converter to switch between PEM, DER, PKCS#7/P7B, and PFX/PKCS#12 formats in a few clicks. Your files are processed locally in your browser and never transmitted to our servers, keeping your private key completely secure throughout. For those who prefer the command line, we’ve included the equivalent OpenSSL commands for every conversion below.
About SSL Certificate Formats
PEM
.pem, .crt, .cer, .key
The most common format. Base64 encoded ASCII files with -----BEGIN CERTIFICATE----- headers. Used by Apache, Nginx, and most Linux-based servers.
DER
.der, .cer
Binary form of PEM. Used primarily with Java-based platforms (Tomcat, etc.) and some Windows applications.
PKCS#7 / P7B
.p7b, .p7c
Base64 ASCII format containing certificates and chain certs. Does not include private keys. Used by Windows and Java Tomcat.
PFX / PKCS#12
.pfx, .p12
Binary format storing the certificate, chain, and private key in one encrypted file. Used by Windows IIS and other Windows applications.
OpenSSL Command Reference
You can also convert certificates using OpenSSL on the command line:
PEM to DER
openssl x509 -outform der -in cert.pem -out cert.der
PEM to PKCS#7
openssl crl2pkcs7 -nocrl -certfile cert.pem -out cert.p7b
PEM to PFX
openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert.pem -certfile chain.pem
DER to PEM
openssl x509 -inform der -in cert.der -out cert.pem
PFX to PEM
openssl pkcs12 -in cert.pfx -out cert.pem -nodes
PKCS#7 to PEM
openssl pkcs7 -print_certs -in cert.p7b -out cert.pem
