Free SSL Certificate Converter
Convert SSL certificates between PEM, DER, PKCS#7 (P7B), and PKCS#12 (PFX) formats in real time with client-side privacy.
100% Client-Side Privacy: Standard conversions (PEM ↔ DER ↔ P7B) run directly inside your browser memory using Web APIs. No certificate data is stored on our servers.
Converted Output
Understanding SSL & TLS Certificate Formats
SSL and TLS certificates are distributed in several standardized cryptographic container formats depending on the target operating system, web server daemon, or load balancer. Moving a certificate from an Apache/Nginx Linux environment to Microsoft Windows IIS or Java Tomcat frequently requires format conversion.
| Format | File Extensions | Encoding | Common Use Cases |
|---|---|---|---|
| PEM | .pem, .crt, .cer, .key |
Base64 ASCII (Text) | Apache, Nginx, Linux, OpenSSL, Cloudflare, AWS ALB |
| DER | .der, .cer |
Binary ASN.1 | Java platforms, legacy embedded devices, Windows CAs |
| PKCS#7 (P7B) | .p7b, .p7c |
Base64 ASCII | Windows Server, Microsoft Exchange, Java Keystore (chains only) |
| PKCS#12 (PFX) | .pfx, .p12 |
Binary (Encrypted) | Microsoft IIS, Azure App Service, macOS Keychain (holds private key) |
How to Convert Your Certificate
- For Apache/Nginx to Windows IIS: Choose PEM to PFX (PKCS#12). Provide both your certificate PEM and private key PEM, and optionally an encryption password.
- For Java applications requiring binary DER: Choose PEM to DER and download the compiled binary
.derfile. - For viewing a binary DER certificate in text editor: Choose DER to PEM to restore standard ASCII base64 blocks.
Frequently Asked Questions (FAQ)
No. The PKCS#7 (P7B) format only stores public certificates and intermediate CA chains. It does not include private keys.
Yes. If you have an OpenSSL terminal, you can run
openssl pkcs12 -in bundle.pfx -out cert.pem -nodes to extract the certificate and private key.
Yes. Standard PEM to DER and DER to PEM conversions run 100% locally in your web browser memory using client-side JavaScript. Nothing is sent over the internet.