How to convert PEM, PKCS7, DER or PKCS#12 SSL certificates

Common questions about SSL certificate extensions

One of the most confusing things about SSL certificates is, without a doubt, the many formats they come in. Starting with the basics, know that all SSL certificates are x.509 certificates. That’s the standard format for the structure of a public key. However, most questions have to do with file extensions and compatibility with systems.

SSL certificates can be issued using different encoding algorithms, and come with the extensions CER, CRT, DER, PEM, P7B, P7S, PFX and P12.

Keep in mind that:

• Certificate Authorities (CAs) issue certificates in different formats;
• Different servers accept different types of certificate.

If you have a certificate with a different extension from the one your server requires, you need to convert the SSL certificate to the format you need. For example: if you have a certificate in PKCS7 but the server only accepts PEM, you need to convert it before using it.

To make it easier, let’s look a little more closely at the most common types of certificate.

PEM

PEM (Privacy-enhanced Mail) is the certificate format most often issued by Certificate Authorities (CAs). PEM files are ASCII BASE64 encoded and come in several formats, such as .pem, .crt, .cer or .key. They’re widely used on servers that use OpenSSL, such as Apache and NGINX.

This certificate is marked by the lines -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----. Other PEM files follow the same pattern:

• Private key: between -----BEGIN RSA PRIVATE KEY----- and -----END RSA PRIVATE KEY-----.
• CSR: between -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST-----.

P7B/PKCS#7

P7B/PKCS#7 certificates are ASCII BASE64 encoded and come as .p7b or .p7c files. The most common platforms for this type of certificate are Microsoft Windows and Java Tomcat.

These files are marked by the lines -----BEGIN PKCS7----- and -----END PKCS7-----.

DER

DER stands for “distinguished encoding rules” and is a binary form of PEM certificates. This format applies to both certificates and private keys and mostly uses the .cer and .der extensions. It’s very common on Java platforms.

PFX/P12/PKCS#12

The PFX/P12/PKCS#12 format usually has the .pfx or .p12 extension. It’s typically used on Windows.

How do I convert SSL certificates?

The easiest way to convert an SSL certificate is with an online tool, but that may expose your certificate to third parties. The safest way, however, is to use the free OpenSSL software and do the conversions right on your computer. Below are the main conversion commands:

Convert X.509 to PEM

openssl x509 -in certificatename.cer -outform PEM -out certificatename.pem

Convert DER to PEM (binary to Base64 ASCII)

openssl x509 -inform der -in certificatename.der -out certificatename.pem

Convert PEM to DER (Base64 ASCII to binary)

openssl x509 -outform der -in certificatename.pem -out certificatename.der

Convert PEM to PKCS#7 (.p7b doesn’t include the private key)

openssl crl2pkcs7 -nocrl -certfile certificatename.pem -out certificatename.p7b -certfile CACert.cer

Convert PKCS#7 to PEM

openssl pkcs7 -print_certs -in certificatename.p7b -out certificatename.pem

Convert PKCS#12 to PEM (PKCS#12 is password protected)

openssl pkcs12 -in certificatename.pfx -out certificatename.pem

Convert PKCS7 to PKCS12

This conversion takes 2 steps. First you convert the P7B file to CER, and then you combine the CER file and the private key into a PFX file.

openssl pkcs7 -print_certs -in certificatename.p7b -out certificatename.cer

openssl pkcs12 -export -in certificatename.cer -inkey privateKey.key -out certificatename.pfx -certfile cacert.cer