SSL Converter

Convert certificates between PEM and DER, and split a full-chain bundle into its individual certificates. Paste it or upload the file.

The file you paste or upload stays in your browser. This tool makes no network request — nothing is uploaded, logged or stored.

What it handles

PEM → DER

For systems that want raw binary — Java keystores, Windows tools.

DER → PEM

Turn a .der or binary .cer into the armoured form config files want.

CRT → PEM

Normalise a .crt of either format into clean, correctly wrapped PEM.

Split a bundle

Break a fullchain.pem into leaf and intermediates, in order.

# The OpenSSL equivalents
openssl x509 -in certificate.pem -outform der -out certificate.der
openssl x509 -in certificate.der -inform der -out certificate.pem

Converting will not fix a broken chain

Re-encoding changes the container, not the contents. If clients report an untrusted certificate, the usual cause is a missing intermediate rather than a wrong format — the server is sending its leaf alone. Confirm what is actually being served with the SSL checker, then rebuild the bundle with the intermediate included.

SSL converter FAQ

What is the difference between PEM and DER?

They are two encodings of the same certificate. DER is the raw binary form. PEM is that binary base64-encoded and wrapped in BEGIN and END lines so it survives being pasted into a config file or an email. Converting between them changes nothing about the certificate — the bytes underneath, and therefore the fingerprint, are identical.

What about .crt, .cer and .pem file extensions?

The extension tells you almost nothing: .crt and .cer files contain PEM roughly as often as DER, and Windows tools favour .cer for both. Open the file in a text editor — if it starts with -----BEGIN CERTIFICATE-----, it is PEM; if it looks like binary noise, it is DER. This tool sniffs the format either way, so you can paste or upload without knowing.

How do I split a full-chain bundle into separate certificates?

Paste the whole bundle. Each PEM block is listed separately, in the order the file has them — normally your leaf certificate first, then one or more intermediates. Some systems want the chain in a single file, others want the leaf and the intermediates apart, and this makes either arrangement a copy away.

Is my certificate uploaded anywhere?

No. Both pasting and the file upload are handled in your browser — the file is read with the FileReader API and never sent. This page makes no network request while converting, which you can confirm in your browser’s network tab.

Can it convert private keys?

It will re-encode a PEM private key block between armoured and base64 forms, and the block label is preserved. It cannot decrypt an encrypted key or convert between key container formats such as PKCS#12 (.pfx) — for those, use OpenSSL locally, which is the right place for private key surgery anyway.

What about PKCS#12 / .pfx files?

Those are password-protected archives bundling a certificate and its private key, and this tool does not open them — extracting one requires the password, and a password plus a private key is not something to hand to a web page. Use OpenSSL: openssl pkcs12 -in bundle.pfx -out certificate.pem -nodes.

How do I convert between PEM and DER with OpenSSL?

PEM to DER: openssl x509 -in certificate.pem -outform der -out certificate.der. DER to PEM: openssl x509 -in certificate.der -inform der -out certificate.pem. The same -inform and -outform flags work for openssl req and openssl rsa.

More free SSL tools

Stop checking by hand

Once the right file is in the right place, SSLNudge keeps watch and tells you before it expires.

Start monitoring free