SSL Converter

The SSL Converter changes your SSL/TLS certificate between PEM, DER, PFX, and P7B entirely in your browser. Your certificate and private key are never uploaded to SSL Dragon or any server.

Switch formats in a few clicks so the certificate installs cleanly on whatever server or platform expects a different one.

---

What an SSL Converter Does

An SSL certificate converter repackages your certificate file. It changes the file’s container and encoding, not the cryptographic content inside. The same X.509 certificate, the standard that defines what a digital certificate holds, comes out the other side in a shape your server can read.

Why bother? A certificate authority might issue your files in one format while your platform expects another. Windows wants a single PFX bundle. Apache wants separate PEM files. Rather than reissue anything, you reformat what you already have.

---

SSL Certificate Formats Explained

PEM

PEM is the text format most certificate authorities issue by default. Files are Base64-encoded ASCII, meaning printable text that stands in for binary data, and they carry —–BEGIN CERTIFICATE—– and —–END CERTIFICATE—– lines. Extensions include .pem, .crt, .cer, and .key. Apache, Nginx, and most Linux servers read PEM, and nearly every conversion routes through it.

DER

DER holds the same X.509 data as PEM, serialized straight to binary through ASN.1, the notation that defines the certificate’s structure. It usually carries a .der or .cer extension and turns up on Java and Android. Because PEM adds Base64 overhead, a PEM file runs roughly 33% larger than its DER equivalent.

PKCS#7 / P7B

P7B is a Base64 text format with a .p7b or .p7c extension. It bundles your certificate and the chain above it, but never the private key. Both Windows and Java Tomcat accept P7B.

PKCS#12 / PFX

PFX packs the certificate, its intermediate chain, and the private key into one password-protected binary file, using a .pfx or .p12 extension. Windows, IIS, and Azure rely on it for import and export.

Watch the .cer and .crt trap. A file ending in .cer or .crt can be PEM text or DER binary inside. Your only reliable check is opening it and looking for the BEGIN/END lines. The converter detects the real encoding and tells you what it found, so you don’t have to guess.

---

Convert Between Certificate Formats

Pick your target format in the tool above and it handles the rest, from detecting what you uploaded to separating the result into ready files.

Working from a terminal instead, or keeping a private key entirely on your own machine? Our SSL certificate formats guide covers the OpenSSL commands for these conversions.

Convert PFX to PEM (and PEM to PFX)

Moving a certificate off Windows onto a Linux server means unpacking a PFX into PEM. Going the other way bundles your PEM certificate and key into a PFX for IIS.

Unpack a PFX here and the tool hands back the certificate, the CA chain, the full chain, and the private key as four separate files, each ready to download or copy. No hunting through a combined file in a text editor to split it by hand. To build a PFX instead, supply the certificate together with its private key, since the format keeps both inside.

Convert CRT or CER to PEM (and PEM to CRT)

Here is the part that trips people up: a .crt or .cer file is usually already PEM. When it is, converting it to .pem amounts to confirming the encoding and renaming, and the converter shows you which encoding you have. When the file is DER-encoded instead, the tool re-encodes it into PEM text.

Need the manual walkthrough on Linux and Windows? Follow our step-by-step guide to convert CRT to PEM with OpenSSL.

Convert CRT or CER to PFX

Building a PFX takes two ingredients: the certificate and its private key. Supply both in the same input, since PFX bundles the key inside and a certificate alone won’t do. Add the chain too and the converter returns one importable file for IIS or Azure.

Convert DER to PEM (and PEM to DER)

Java tooling and some appliances expect DER binary, while web servers expect PEM text. Drop in a .der or DER-encoded .cer and you get back readable PEM; feed it PEM and you get compact DER.

Convert P7B to PEM (and P7B to PFX)

A P7B carries certificates and the chain, with no private key inside. Converting it to PEM pulls those certificates into readable text you can install or split apart.

Reaching PFX from a P7B takes two passes, because a P7B holds no private key. Convert the P7B to PEM first, then convert that PEM together with your private key into a PFX.

Private Keys and .p12 Files

A .p12 file and a .pfx file are the same PKCS#12 format wearing different extensions, so switching between them is a rename. Whenever your input contains a private key, the converter surfaces it as its own downloadable output beside the certificate.

---

Which Format Does My Server Need?

Platform	Format to use	Typical extension
Apache, Nginx	PEM	.pem, .crt, .key
Microsoft IIS, Windows, Azure	PFX / PKCS#12	.pfx
Java, Tomcat	PKCS#12 (PFX)	.pfx, .p12
Android, network appliances	DER	.der

Java keystores (JKS) sit outside this converter. To reach one, create a PFX first and import it with the keytool utility.

---

Need an SSL Certificate?

Converting a certificate you bought elsewhere? When renewal comes around, SSL Dragon carries certificates from Sectigo, Comodo, GoGetSSL, RapidSSL, GeoTrust, DigiCert, and Thawte. Domain Validation starts at $7.66 per year, with Organization and Extended Validation available for sites that need a verified identity.

---

अक्सर पूछे जाने वाले प्रश्नों