Keep conversion local
Certificates, private keys, and passwords are processed in your browser. No account or upload to a server is required.
PEM · DER · CRT · CER · P7B · PFX / P12
SSL Certificate Format Converter.
Convert SSL certificates online for Nginx, Apache, IIS, or your cloud platform. Convert PEM to PFX, DER to PEM, or P7B to PEM locally in your browser, with your keys and passwords kept in this tab.
Browser-only conversion · Certificates, keys, and passwords stay local
CERTIFICATE DEPLOYMENT
Use the certificate format your server expects.
A certificate downloaded from your CA may use a different format from the one your server accepts. This converter changes its encoding or container while keeping the issued certificate intact.
Check the key before PFX export
RSA and ECC public keys are compared before a private key is packaged with its certificate.
Preserve the certificate chain
Include intermediate certificates in PEM, P7B, or PFX output, or export each certificate separately as DER.
COMMON SSL CONVERSIONS
From CRT to PEM, or from PEM to PFX.
CRT / CER to PEM
Normalize a text or binary certificate for a server that expects PEM. The extension alone cannot identify its encoding.
Convert certificatePEM to DER / DER to PEM
Switch between readable PEM and binary DER while preserving the signed X.509 certificate.
Convert certificatePEM / CRT to PFX
Package a certificate, matching private key, and optional CA bundle for Windows IIS. Choose an export password.
Convert certificatePFX to PEM / CRT
Open a password-protected PFX/P12 and download its certificate chain and private key as separate PEM files.
Convert certificateP7B to PEM / PEM to P7B
Extract certificates from PKCS#7, or package a PEM chain in a certificate-only P7B container.
Convert certificatePFX to DER / P7B
Export public certificates from a PKCS#12 package. The output omits private keys and reports that omission.
Convert certificateHOW TO CONVERT SSL CERTIFICATES
Choose the output. Keep the original identity.
You do not need to identify the input encoding. The converter reads the actual contents of your file rather than trusting its name.
- 01
Paste or upload the certificate
Use the complete PEM blocks or upload a binary DER, P7B, or PFX/P12 file. Enter the import password for protected PFX files.
- 02
Choose PEM, DER, P7B, or PFX
For a new PFX, provide the matching unencrypted private key and an export password. Add intermediate certificates in issuer order when needed.
- 03
Convert and download the output
Review the detected format, certificate count, and key-handling notices. Download each result; PEM output can also be copied.
PEM VS DER VS P7B VS PFX
SSL certificate formats and file extensions.
PEM and DER describe encodings. P7B and PFX describe containers. CRT and CER are extensions that may use either PEM or DER, so changing the filename is sufficient only when the encoding already meets your server’s requirements.
| Format | Encoding | Contents | Typical use |
|---|---|---|---|
| PEM / CRT / CER | Base64 text with PEM boundaries | One or more certificates; keys exported separately | Nginx, Apache, and cloud load balancers |
| DER | Binary ASN.1 | One certificate per file | Systems requesting a binary .der or .cer certificate |
| P7B / PKCS#7 | Binary export; PEM or binary import | Certificates and chain, without a private key | Certificate-chain transfer and Windows certificate imports |
| PFX / P12 / PKCS#12 | Binary container with password protection | Certificate, matching private key, and optional chain | Windows IIS and applications accepting PKCS#12 |
Convert SSL certificate formats with OpenSSL.
Run these commands locally if you prefer a terminal, need encrypted standalone key support, or encounter an unsupported PFX encryption algorithm. Passwords are entered through OpenSSL prompts.
PEM / CRT → DER
openssl x509 -in certificate.crt -outform DER -out certificate.derDER / CER → PEM
openssl x509 -inform DER -in certificate.cer -out certificate.pemPEM / CRT + KEY → PFX
openssl pkcs12 -export -in certificate.pem -inkey private.key \
-certfile chain.pem -out certificate.pfxOmit -certfile if no intermediate CA bundle is needed. OpenSSL prompts for the export password.
PFX → PEM certificate chain
openssl pkcs12 -in certificate.pfx -nokeys -out certificates.pemPFX → unencrypted private key
openssl pkcs12 -in certificate.pfx -nocerts -noenc -out private-key.pemThe output key is unencrypted. Omit -noenc to protect it with a new passphrase.
P7B → PEM
openssl pkcs7 -inform DER -in certificate.p7b -print_certs -out certificates.pemUse -inform PEM when the P7B is PEM encoded.
PEM chain → P7B
openssl crl2pkcs7 -nocrl -certfile certificates.pem \
-outform DER -out certificate.p7bCommand reference: openssl x509, openssl pkcs12, and openssl pkcs7.
RELATED SSL TOOLS
Inspect certificates and prepare their keys.
SSL Certificate Decoder
Inspect domains, issuer, expiry, and certificate extensions before deployment.
Open toolCertificate Key Matcher
Check whether an issued SSL certificate matches your RSA or ECC private key.
Open toolCSR & Private Key Matcher
Compare a CSR with its private key before requesting a certificate.
Open toolPKCS#1 / PKCS#8 Converter
Convert private and public key structures when your server expects a different PEM header.
Open toolSSL CERTIFICATE CONVERSION FAQ
Common certificate format questions.
How do I convert an SSL certificate online?
Paste PEM text or upload a PEM, CRT, CER, DER, P7B, PFX, or P12 file. Choose the output format and select Convert Certificate, then download the result. Binary input is detected from its contents. PFX export needs a matching private key; protected PFX input needs its password.
How do I convert CRT or CER to PEM?
CRT and CER are filename extensions, not distinct encodings. They may contain PEM text or binary DER. Upload the file and select PEM to normalize the certificate. If it already begins with BEGIN CERTIFICATE, it is PEM encoded. Simply renaming a binary file will not convert it.
Can I convert PEM or CRT to PFX without a private key?
This tool creates deployment-ready PFX/P12 packages containing a certificate and its matching private key. Provide the original RSA or EC key, plus intermediate certificates if needed. A certificate cannot be used to reconstruct a missing private key. Certificate-only PKCS#12 containers exist, but this tool requires a key for PFX export.
How do I convert PFX to PEM or CRT and extract the private key?
Upload the PFX or P12 and enter its import password. Choose PEM or CRT. The result includes the certificates in one PEM-encoded file and any private keys in separate PEM files. Extracted private keys are unencrypted, so store them securely. Choose DER or P7B for certificate-only output.
What is the difference between PFX and P12?
PFX and P12 are commonly used extensions for the same PKCS#12 container format. The container can bundle certificates, a private key, and intermediate certificates, with password protection. Select either extension here to export the same PKCS#12 structure.
Does P7B contain a private key?
A P7B/PKCS#7 certificate bundle contains certificates and can carry a certificate chain; it does not carry a private key. Converting P7B to PEM extracts its certificates. To create a PFX from them, supply the matching private key separately.
Which format should I use for Nginx, Apache, or IIS?
Nginx and Apache commonly use PEM certificates with a separate PEM private key. Windows IIS commonly imports a PFX/P12 containing the certificate and private key. DER is a binary encoding for an individual certificate; P7B transfers a certificate chain. Check the target platform's requirements before installation.
Are my certificate, private key, and passwords uploaded?
No. Files are read and converted in the current browser tab. This tool does not send inputs to a server, store them, or add them to the URL. Clear the form or close the tab when finished. Downloaded files and clipboard copies remain under your control.
Does the converter support RSA and ECC certificates?
Yes. Certificate conversion preserves the signed certificate bytes. PFX export supports RSA and ECDSA keys on P-256, P-384, and P-521, with unencrypted PKCS#8, RSA PKCS#1, or EC SEC1 PEM input. Encrypted standalone private keys and unsupported PFX encryption should be handled with OpenSSL locally.
Does converting a certificate renew it or validate the chain?
No. Conversion changes encoding or packaging, while retaining the certificate's subject, validity dates, and signature. It does not renew an expired certificate, establish trust, verify chain signatures, or download missing intermediate certificates. DER output provides a separate file for each certificate in a chain.