SSL Certificate Converter: Convert PEM, DER, PFX

SSL certificates come in multiple file formats — and frustratingly, different servers, platforms, and applications require different formats. A certificate that works perfectly on Apache will not install directly on Windows IIS. A certificate exported from one system may need to be converted before it can be imported into another. This guide covers every common SSL certificate format, when to use each one, and how to convert between them using a free online tool.

SSL Certificate Formats Explained

PEM Format (.pem, .crt, .cer, .key)

The most common format for Linux-based servers (Apache, Nginx). PEM stands for Privacy Enhanced Mail — a legacy name from its original use in email encryption. PEM files are Base64-encoded ASCII text and can be opened in any text editor. They always start and end with a header/footer line:

-----BEGIN CERTIFICATE-----
(base64 encoded data)
-----END CERTIFICATE-----

A PEM file can contain a single certificate, a certificate chain (multiple certificates concatenated), or a private key. The .crt, .cer, and .pem extensions are all commonly used for PEM-encoded certificates — they are the same format despite different extensions.

DER Format (.der, .cer)

The binary version of the same X.509 certificate data. DER (Distinguished Encoding Rules) is used by Java-based applications and older Windows systems. A DER file cannot be opened in a text editor — it looks like binary garbage. The .cer extension can be either PEM or DER — you need to open the file to determine which.

PFX / PKCS#12 Format (.pfx, .p12)

A container format that bundles the certificate, private key, and certificate chain all into one encrypted file. PFX (also called PKCS#12 or P12) is the native format for Windows servers (IIS) and is used for code signing certificates. The file is password-protected. When you export a certificate from Windows or a browser, PFX is typically the export format.

P7B / PKCS#7 Format (.p7b, .p7c)

A container for certificates and certificate chains only — it does not include the private key. Used by Windows IIS and Java Tomcat. P7B files can hold an entire chain (root + intermediate + leaf certificate) in one file. They are Base64-encoded like PEM but use different header lines: -----BEGIN PKCS7-----.

Which Format Does Your Server Need?

How to Convert SSL Certificates Using Our Free Tool

Our SSL Converter handles the most common format conversions online — no OpenSSL installation required:

1. Open the SSL Converter.
2. Select the conversion type (e.g., PEM to PFX, PFX to PEM, DER to PEM).
3. Upload or paste your certificate file.
4. For PFX conversions, provide the password and optionally include the private key and chain.
5. Click Convert and download the result.

Common SSL Certificate Conversions

PEM to PFX (for Windows IIS)

Requires: your .crt certificate file, your .key private key file, and optionally the CA chain file.

openssl pkcs12 -export -out certificate.pfx -inkey private.key -in certificate.crt -certfile ca-chain.crt

You will be prompted to set a password for the PFX file. This password is required when importing into IIS.

PFX to PEM (from Windows to Linux)

Extracts the certificate and private key from a PFX into separate PEM files.

# Extract certificate
openssl pkcs12 -in certificate.pfx -nokeys -out certificate.crt

# Extract private key (no passphrase)
openssl pkcs12 -in certificate.pfx -nocerts -nodes -out private.key

DER to PEM

openssl x509 -inform DER -in certificate.der -out certificate.pem

PEM to DER

openssl x509 -outform DER -in certificate.pem -out certificate.der

PEM to P7B (for IIS chain import)

openssl crl2pkcs7 -nocrl -certfile certificate.pem -certfile ca-chain.pem -out certificate.p7b

After Converting: Verify Your Certificate

After any format conversion, always verify the result before installing it:

• Use the Certificate Decoder to confirm the converted certificate contains the correct fields
• Use the Certificate Key Matcher to confirm the private key still matches the certificate
• After installation, use the SSL Checker to verify the live site is serving the certificate correctly

Troubleshooting Common Conversion Errors

• "MAC verification failed" during PFX extraction — the password is wrong or the file is corrupted
• "No certificate matches private key" after conversion — check with the Certificate Key Matcher; the certificate and key may be from different pairs
• Certificate chain missing after conversion — re-export including the chain file and use -certfile ca-chain.crt in the OpenSSL command
• IIS import fails after PEM to PFX — the PFX password may contain special characters that IIS cannot process; use a simple alphanumeric password

Frequently Asked Questions

What is the difference between .crt and .pem files?

Both are usually PEM format (Base64-encoded text). The extension .crt is commonly used for certificate files specifically, while .pem can contain certificates, private keys, or chains. They are often interchangeable — you can rename .crt to .pem and it will work the same way.

Do I need the private key to convert a certificate?

For most conversions (PEM to DER, DER to PEM, PEM to P7B) you only need the certificate file. For PFX conversions, you need the private key because PFX bundles both together. For conversions that extract from PFX, you need the PFX password.

Can I convert a certificate without the original private key?

You can convert the certificate file between formats without the private key. But for PFX export (which bundles certificate + key), you need the private key. If the private key is lost, you need to reissue the certificate — use our CSR Generator to start the process.

Is there a certificate format that works on all servers?

PEM is the most widely supported format. All major servers can accept PEM certificates, and most tools and libraries work with PEM by default. When in doubt, convert to PEM and store the certificate and private key as separate files.