Certificate Format Converter
The Certificate Format Converter is a fast, browser-based tool that takes the complexity out of certificate format conversion. Instead of installing OpenSSL or running command-line tools, you simply upload your certificate, select the target format, and download the converted file in seconds, supporting PEM, DER, CRT, CER, PKCS#7, and PKCS#12.
Base64 ASCII · .pem
Binary ASN.1 · .der
Please Note: Encryption Consulting LLC does not possess, store, or retain any data entered into this converter. All inputs, including certificate files and private keys, are processed locally in your browser and are not saved.
Help & Support
Frequently Asked Questions
Everything you need to know about converting certificate formats. Can't find the answer you're looking for? Send us an email
Using the Certificate Format Converter is straightforward. Follow these three steps:
- Upload Your Certificate File Upload a .pem, .crt, .cer, .der, .pfx, or .p7b file. The tool auto-detects the format and shows the certificate details.
- Select the Target Format Use the TO dropdown to select the format you want to convert to — PEM, CRT, DER, CER, PKCS#7, or PKCS#12.
- Convert and Download Click Convert. The converted file is processed entirely in your browser and saved to your device.
To generate a certificate signing request before conversion, you can use our CSR Generator Tool.
Certificate formats differ in encoding, structure, and what they can contain:
- PEM PEM is a Base64-encoded certificate format stored as a text file. Commonly used on Linux, Apache, and NGINX. Extensions include .pem, .crt, .cer, or .key.
- DER DER is the binary-encoded version of a certificate and is not human-readable. Used by Windows environments, Java, and network devices. Extensions: .der or .cer.
- CRT/CER CRT/CER are extensions rather than unique formats — a file may be either PEM or DER encoded. Commonly used for SSL/TLS certificates on Linux and web servers.
- PKCS#7 PKCS#7 stores one or more certificates and certificate chains without private keys. Used for certificate distribution. Extensions: .p7b or .p7c.
- PKCS#12 PKCS#12 bundles certificates, private keys, and chains into a single password-protected file. Common extensions: .pfx and .p12.
Certificate format conversion is required across a wide range of infrastructure, development, and security workflows:
- Web Server Deployment Linux-based servers like Apache and Nginx require PEM format, while IIS expects PKCS12.
- Cloud & DevOps Azure Key Vault and AWS ACM require PKCS12 when bundling certificates with private keys. Kubernetes TLS Secrets and HAProxy demand PEM.
- Mobile & Application Development Android and Java keystores require DER; iOS signing uses PKCS12 to bundle the certificate and private key.
- Enterprise & Active Directory Group Policy distribution requires DER .cer files; ADCS renewal requires PKCS7 (.p7b).
- Hardware, Code Signing & Inspection HSMs store DER; Windows code signing uses PKCS12; OpenSSL inspection requires PEM or DER.
Private keys can be stored in PEM and PKCS#12 (PFX/P12) formats. PKCS#12 is designed to securely bundle certificates, private keys, and chains in a single password-protected file.
DER, CRT, CER, and PKCS#7 contain certificates and certificate chains only and do not store private keys.
Every Layer of Cryptography.
One Team to Secure It.
See how Encryption Consulting secures what your enterprise depends on, from assessment through deployment.
Request a Demo