PEM to DER & P7B Certificate Converter
Convert certificates between PEM, DER and Base64, unpack .p7b bundles, and put a chain in order. Free, and runs in your browser.
About Certificate Converter
The same certificate is stored in several ways. PEM is Base64 between BEGIN and END lines, which nginx, Apache, Node and most Linux tools want. DER is the same bytes in binary, which Java keystores, Windows and many devices want. A .p7b or .p7c file is a PKCS#7 bundle holding several certificates, which is what Windows exports and some CAs send.
This reads any of them — pasted PEM, one-line Base64, or a .der, .cer, .crt or .p7b file — and writes them back as PEM, as DER files, or as one-line Base64 for environment variables and JSON.
Bundles are checked, not just converted. Each certificate is decoded and listed with its issuer and expiry. The chain can be put in the order servers must send it, leaf first and each certificate followed by its issuer. An expired certificate, a root included where it is not needed, and a private key in the input are all pointed out.
Where it helps
- Reads PEM, Base64 DER, binary DER and PKCS#7 bundles, detected automatically.
- Decodes every certificate in a bundle and lists its subject, issuer and expiry.
- Puts a chain in the order servers must send it, and flags a chain that is out of order.
- Runs in the browser, so certificates and any key pasted by mistake are never sent anywhere.
Limits
- PFX and PKCS#12 files are password-protected and are not read here. Use the OpenSSL helper for the command that unpacks them.
- Ordering matches certificates by subject and issuer name. It does not check the signatures, which the chain validator does for a live host.
Frequently asked questions
What is the difference between .crt, .cer, .pem and .der?
The extension says little. .pem is always PEM text. .der is always binary. .crt and .cer can be either, depending on who made them. Open the file in a text editor: if it starts with -----BEGIN it is PEM, otherwise it is DER. This tool reads both, whatever the name.
What order should the certificates in a chain be in?
The server's own certificate first, then the intermediate that issued it, then the one that issued that, and so on. Leave the root out: clients already have it. nginx's ssl_certificate and a fullchain.pem both expect this order, and a wrong order breaks some clients even when browsers cope.
How do I get certificates out of a .p7b file?
Choose the file, or paste it if it is in PEM form, and convert to PEM. Every certificate inside is written out as its own PEM block, in chain order, ready for a server configuration.
Related tools
- Certificate Viewer — Decode a PEM certificate or CSR in the browser
- Certificate Chain Validator — Walk the served chain and flag ordering and trust problems
- OpenSSL Helper — Build the command, read one somebody sent you, and check a key against its certificate
- Self-Signed Certificate Generator — Create a certificate and key for local HTTPS, or a private CA to sign development certificates
- SSL Checker — Grade a TLS endpoint and inspect the certificate it serves
- Certificate Expiry Checker — Check expiry dates for up to ten hosts at once
More SSL & Certificates tools
- SSL Checker — Grade a TLS endpoint and inspect the certificate it serves
- Certificate Chain Validator — Walk the served chain and flag ordering and trust problems
- Certificate Expiry Checker — Check expiry dates for up to ten hosts at once
- Certificate Viewer — Decode a PEM certificate or CSR in the browser
- OpenSSL Helper — Build the command, read one somebody sent you, and check a key against its certificate
- CSR Generator — Generate a key pair and certificate signing request locally
- Self-Signed Certificate Generator — Create a certificate and key for local HTTPS, or a private CA to sign development certificates
- Certificate Transparency Search — Every certificate public CAs have issued for a domain, the subdomains they reveal, and what is about to expire