SSL Certificate Converter

The converter moves certificates and private keys between formats: PEM and DER, PKCS#1 and PKCS#8, a chain in P7B, a bundle in PFX. You don't need to pick an input format — the tool reads the file and tells you what's inside.

A note on private keys

A private key that has touched someone else's machine is considered compromised. After that, the certificate should be reissued. This is the main reason the tool works the way it does.

What the tool reads

• certificates and chains in PEM and DER (.crt, .cer, .pem, .der);
• certificate signing requests (CSR);
• RSA and EC private keys: PKCS#1, SEC1, PKCS#8;
• encrypted keys: both current PKCS#8 and older ones with a Proc-Type header;
• PKCS#7 chains (.p7b, .p7c);
• PKCS#12 bundles (.pfx, .p12), including those locked with old ciphers.

How the formats differ

PEM and DER are the same content in different packaging. PEM is text, framed by BEGIN and END lines, and opens in any text editor. DER is binary. Linux servers usually expect PEM, while Java and Windows more often take DER.

PKCS#1 and PKCS#8 are two ways to write down a private key. In PKCS#1 the frame says RSA PRIVATE KEY; in PKCS#8 it just says PRIVATE KEY, and the key type is recorded inside. Nginx and Apache read both; older software sometimes only PKCS#1.

P7B stores a certificate chain without a key, and IIS and Tomcat ask for it. PFX stores the key and the chain together under a password, and Windows, IIS, and certificate store imports ask for it.

To see what a live site is running, use the SSL certificate check.