PFX to PEM, CER to PEM, PEM to PFX or P7B – plus CSR creation and certificate inspection. Everything runs locally in your browser, nothing is uploaded.
1Input file
2Check chain & extract individually
Root CA, intermediate(s) and end-entity certificate are detected automatically and can be downloaded individually as PEM or DER.
3Target format (convert the whole file)
Every conversion works two ways: right here in the browser or with OpenSSL on the command line. The converter shows the matching command for every step, and the most common ones are listed here too.
Splits a PKCS#12 container into certificate, private key and chain, e.g. for Apache, nginx or HAProxy.
In the converter: Drop the file on the “Convert” tab, enter the password, choose PEM as the target format.
openssl pkcs12 -in bundle.pfx -clcerts -nokeys -out cert.pem
openssl pkcs12 -in bundle.pfx -nocerts -nodes -out key.pemBundles certificate, key and intermediates into one password-protected file, e.g. for Windows, IIS or Exchange.
In the converter: Drop the certificate, add the key and intermediates, choose PKCS#12 as the target format.
openssl pkcs12 -export -in cert.pem -inkey key.pem \
-certfile chain.pem -out bundle.pfxTurns a binary certificate into the text form starting with -----BEGIN CERTIFICATE-----.
In the converter: Drop the file, the format is detected automatically, choose PEM.
openssl x509 -inform der -in cert.cer -out cert.pemCreates the binary form expected by Java, Windows and some appliances.
In the converter: Drop the PEM file or paste the text, choose DER.
openssl x509 -in cert.pem -outform der -out cert.derExtracts every certificate of a chain from a P7B file, as delivered by many certificate authorities.
In the converter: Drop the P7B, the chain is shown. Root and intermediates can be downloaded individually.
openssl pkcs7 -print_certs -in chain.p7b -out chain.pemBundles certificate and chain without the private key, e.g. for Windows or Tomcat.
In the converter: Drop certificate and intermediates, choose PKCS#7.
openssl crl2pkcs7 -nocrl -certfile chain.pem -out chain.p7bCreates a certificate signing request with subject fields and SANs, using a new or an existing key.
In the converter: Open the “Create CSR” tab, enter common name and SANs, let it generate a key.
openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out request.csr \
-subj "/CN=www.example.com" \
-addext "subjectAltName=DNS:www.example.com,DNS:example.com"Shows validity, issuer, extensions and fingerprints and checks whether certificate, key and CSR belong together.
In the converter: Drop the files on the “Inspect” tab, matching pairs are highlighted automatically.
openssl x509 -in cert.pem -noout -text
openssl x509 -in cert.pem -noout -pubkey | openssl sha256
openssl pkey -in key.pem -pubout | openssl sha256| Format | File extensions | Encoding | Typical content and use |
|---|---|---|---|
| PEM | .pem .crt .cer .key | Base64 text | certificates, keys and chains; default for Apache, nginx and Linux |
| DER | .der .cer | binary | a single certificate; common on Windows and Java |
| PKCS#7 | .p7b .p7c | Base64 or binary | certificate chain without private key; Windows, Tomcat |
| PKCS#12 | .pfx .p12 | binary, password-protected | certificate, private key and chain in one file; Windows, IIS, Exchange, browser import |
Yes. The conversion runs entirely in your browser; files and passwords are never sent to a server. You can verify this in the network tab of the developer tools or save the page and use it offline.
The extension says little about the content. A .crt or .cer file can be text (PEM) or binary (DER). The converter detects the format from the content.
Yes. Both extensions stand for PKCS#12, a password-protected container for certificate, private key and chain.
Browsers only trust the root certificate authority. The server has to send the intermediates so the chain is complete. The converter detects chains, sorts them and verifies the signatures.
Yes. All libraries are hosted on this site. Save the page and it works without an internet connection.