EnglishEN

SSL Converter (PEM, DER, PFX, P7B)

Drop certificate and key files to unpack them item by item, then rebuild them in the format you need.

Your text and files never leave your browser — nothing is sent to a server.

Drop certificate or key files here, or click to choose (several at once is fine)
    Contents

    Add files or paste PEM text and each item will be listed here.

      How to use

      1. Drop .pem, .crt, .cer, .der, .key, .p7b, .pfx or .p12 files onto the box above, or paste PEM text. You can add several files at once.
      2. For a PFX/P12 file or an encrypted private key, a password field appears. Enter the password and press Unlock to get the certificates and key as PEM.
      3. Under “Contents”, download each certificate or key on its own as PEM or DER. This is how you split a bundle, and private keys can be switched between PKCS#8 and the traditional PKCS#1/SEC1 format. OpenSSH keys can be turned into PKCS#8 too.
      4. At the bottom, build a chain-ordered PEM bundle (fullchain), a PKCS#7 .p7b file or a password-protected PFX. The PFX automatically pairs the private key with its matching certificate.

      FAQ

      What is the difference between PEM and DER?

      They hold the same data in different encodings. PEM is Base64 text that starts with -----BEGIN and opens in any text editor, while DER is the same structure stored as binary. A .crt or .cer file can be either.

      Should I pick AES-256 or 3DES for the PFX?

      Current Windows, macOS, Java and OpenSSL versions all read AES-256 PFX files, so keep the default. If an older system such as Windows Server 2016, an old macOS release or Java 8 refuses the file, rebuild it with 3DES.

      Unlocking a PFX says the encryption is not supported.

      PFX files encrypted with AES, 3DES, RC2 or RC4 can be opened, including ones that use the newer PBMAC1 integrity check. PFX files encrypted to a public key cannot; unpack those with openssl pkcs12 instead.

      Is it safe to use my private key and password here?

      All conversion happens inside this browser tab. Files, keys and passwords are never sent to a server or stored, and they are gone when you close the page.

      Related tools

      Certificate DecoderRead certificate details and chain orderCertificate Key MatcherDoes this key belong to the cert?CSR & Certificate GeneratorMake a key, CSR and test certificateCSR DecoderCheck a CSR before you submit it

      All tools