Convert your SSL Certificate Format

Easily convert your SSL Certificate to different formats


Free SSL Certificate Converter Tool

Quickly Convert your SSL Certificate to Different Formats

Your private key is intended to remain on the server. While we try to make this process as secure as possible by using SSL to encrypt the key when it is sent to the server, for complete security, we recommend that you manually convert the certificate on your server using the OpenSSL commands below.

SSL Certificate Formats:

PEM format

PEM (formerly "Privacy Enhanced Mail") is the most used file format for X.509 certificates, CSRs, and cryptographic keys. One or more items with Base64 ASCII encoding with plain-text headers as well as footers (such as -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----) are included in a PEM file. An end-entity certificate, a private key, or many certificates completing the whole chain of trust can be found in a single PEM file. PEM format will be used for most certificate files acquired from

Apache and other similar-type servers use PEM format certificates. Even though the private key and multiple PEM certificates can be included in one file, most platforms, including Apache, require the certificates and private keys to be in different files.

DER Format

DER (Distinguished Encoding Rules) is the binary encoding for X.509 certificates and private keys. Unlike PEM, DER-encoded files do not include plain text declarations like -----BEGIN CERTIFICATE-----. Java contexts are where DER files are often seen.

It occasionally has a .der file extension, but it frequently has a .cer file extension; the simplest way to distinguish between a DER.cer file and a PEM.cer file is to open them both in a text editor and check for the BEGIN/END statements. The DER format could be used to encode any certificate or private key. Platforms running Java are frequently utilized with DER. The only format that the SSL Converter can convert certificates to is DER.

PKCS#7/P7B Format

PKCS#7 or P7B format files often have a .p7b or.p7c file extension and are stored in Base64 ASCII format. "-----BEGIN PKCS7-----" and "-----END PKCS7-----" statements are included in P7B certificates. The private key is not included in a P7B file; only certificates and chain certificates are included. Various systems, including Java Tomcat and Microsoft Windows, support P7B files.

P7B/PKCS#7 Format

Certificates in P7B/PKCS#7 formats are encoded using Base64 ASCII, and their file extensions are typically.p7b or.p7c. The fact that only certificates and not private keys can be stored in PKCS#7 format distinguishes it from other formats. Only certificates and chain certificates will be present in a P7B file.

The P7B/PKCS#7 formatted certificates are in the space between the "—-BEGIN PKCS7—-" and "—-END PKCS7—-" statements. Microsoft Windows and Java Tomcat are the two most popular systems that use this format for SSL certificates.

Convert Your SSL Certificate File Format Using OpenSSL Commands

Rather than Free SSL Converter tool, you can use OpenSSL commands even to convert your certificate.

Use the OpenSSL commands to convert your certificates to the key,pem, cer, crt, der, pfx, p12,p7b, p7c, PKCS#12, and PKCS#7 formats.

Sometimes, you receive SSL Certificate in an incompatible format that your server cannot read. As a result, you must change the SSL certificate file format so your server can access it.

To change the format of your SSL certificate file into one compatible with your server, use these simple OpenSSL commands.

Note: The most often used format for certificates is PEM. Cert, crt, and pem are the extensions used for PEM certificates. They are ASCII files with Base64 encoding. The binary representation of the certificate is in DER format. The "BEGIN CERTIFICATE/END CERTIFICATE" phrases are removed from certificates that use the DER format. The '.der' extension is most frequently used with DER-encoded certificates.

OpenSSL Commands to Convert Your PEM File

  • From PEM to DER openssl x509 -outform der -in certificate.pem -out certificate.der
  • From PEM to P7B openssl crl2pkcs7 -nocrl -certfile certificate.cer -out certificate.p7b -certfile CACert.cer
  • From PEM to PFX openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt

OpenSSL Commands to Convert Your P7B File

  • From P7B to PEM openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer
  • From P7B to PFX openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer
    openssl pkcs12 -export -in certificate.cer -inkey privateKey.key -out certificate.pfx -certfile CACert.cer

OpenSSL Commands to Convert Your PFX File

  • From PFX to PEM openssl pkcs12 -in certificate.pfx -out certificate.cer -nodes

OpenSSL Commands to Convert DER File

  • From PFX to PEM openssl x509 -inform der -in certificate.cer -out certificate.pem