SSL Converter
Convert certificates between PEM and DER, and split a full-chain bundle into its individual certificates. Paste it or upload the file.
The file you paste or upload stays in your browser. This tool makes no network request — nothing is uploaded, logged or stored.
What it handles
PEM → DER
For systems that want raw binary — Java keystores, Windows tools.
DER → PEM
Turn a .der or binary .cer into the armoured form config files want.
CRT → PEM
Normalise a .crt of either format into clean, correctly wrapped PEM.
Split a bundle
Break a fullchain.pem into leaf and intermediates, in order.
# The OpenSSL equivalents openssl x509 -in certificate.pem -outform der -out certificate.der openssl x509 -in certificate.der -inform der -out certificate.pem
Converting will not fix a broken chain
Re-encoding changes the container, not the contents. If clients report an untrusted certificate, the usual cause is a missing intermediate rather than a wrong format — the server is sending its leaf alone. Confirm what is actually being served with the SSL checker, then rebuild the bundle with the intermediate included.
SSL converter FAQ
What is the difference between PEM and DER?
They are two encodings of the same certificate. DER is the raw binary form. PEM is that binary base64-encoded and wrapped in BEGIN and END lines so it survives being pasted into a config file or an email. Converting between them changes nothing about the certificate — the bytes underneath, and therefore the fingerprint, are identical.
What about .crt, .cer and .pem file extensions?
The extension tells you almost nothing: .crt and .cer files contain PEM roughly as often as DER, and Windows tools favour .cer for both. Open the file in a text editor — if it starts with -----BEGIN CERTIFICATE-----, it is PEM; if it looks like binary noise, it is DER. This tool sniffs the format either way, so you can paste or upload without knowing.
How do I split a full-chain bundle into separate certificates?
Paste the whole bundle. Each PEM block is listed separately, in the order the file has them — normally your leaf certificate first, then one or more intermediates. Some systems want the chain in a single file, others want the leaf and the intermediates apart, and this makes either arrangement a copy away.
Is my certificate uploaded anywhere?
No. Both pasting and the file upload are handled in your browser — the file is read with the FileReader API and never sent. This page makes no network request while converting, which you can confirm in your browser’s network tab.
Can it convert private keys?
It will re-encode a PEM private key block between armoured and base64 forms, and the block label is preserved. It cannot decrypt an encrypted key or convert between key container formats such as PKCS#12 (.pfx) — for those, use OpenSSL locally, which is the right place for private key surgery anyway.
What about PKCS#12 / .pfx files?
Those are password-protected archives bundling a certificate and its private key, and this tool does not open them — extracting one requires the password, and a password plus a private key is not something to hand to a web page. Use OpenSSL: openssl pkcs12 -in bundle.pfx -out certificate.pem -nodes.
How do I convert between PEM and DER with OpenSSL?
PEM to DER: openssl x509 -in certificate.pem -outform der -out certificate.der. DER to PEM: openssl x509 -in certificate.der -inform der -out certificate.pem. The same -inform and -outform flags work for openssl req and openssl rsa.
More free SSL tools
SSL Checker
Check a live site’s certificate: expiry, issuer, chain and hostname match.
SSL Certificate Decoder
Paste a PEM certificate and read every field — subject, SANs, dates, key, extensions.
CSR Decoder
Check what a certificate signing request actually asks for before you submit it.
CSR Generator
Generate a key pair and CSR in your browser — the key never leaves the page.
SSL Key Matcher
Confirm a certificate, CSR and private key belong to the same key pair.
Stop checking by hand
Once the right file is in the right place, SSLNudge keeps watch and tells you before it expires.