Certificate Format Converter
Different servers want different certificate formats: Nginx and Apache read PEM, Windows / IIS want a PKCS#12 .pfx bundle, and Java keystores often expect PKCS#7 .p7b.
Input
Paste a PEM certificate (-----BEGIN CERTIFICATE-----) to convert it to binary DER. With a chain, the first certificate is converted.
Convert certificate formats online
Different servers want different certificate formats: Nginx and Apache read PEM, Windows / IIS want a PKCS#12 .pfx bundle, and Java keystores often expect PKCS#7 .p7b. This tool converts between all of them in your browser — PEM ↔ DER, PEM → .pfx and back, and PEM ↔ .p7b — so you never have to remember the openssl incantations.
Everything runs client-side with pkijs and node-forge. Private keys and the passwords you type to build or open a .pfx are processed entirely in the browser and are never uploaded — you can confirm it in your browser's Network panel.
Frequently asked questions
Are my private key and password uploaded?
This tool processes certificate or key inputs locally in the browser without sending them to a server for computation. Page-resource loading and tool computation are separate processes; inspect requests in the browser network panel.
How do I build a .pfx for IIS / Windows?
Choose PEM → PKCS#12, paste your certificate and its private key (and any chain certificates), set an export password, and download the .pfx. The result can be imported into IIS or read with openssl pkcs12 -info.
How do I extract the certificate and key from a .pfx?
Choose PKCS#12 → PEM, upload the .pfx/.p12, and enter its password. The tool splits out the private key, the leaf certificate and any chain certificates as separate PEM files.
Is the PEM to DER conversion lossless?
Yes. PEM and DER are just two encodings of the same certificate bytes, so pem → der → pem is byte-for-byte stable. PKCS#12 export currently supports RSA keys.
References and result limitations
Local results depend on the input and selected options. Retain the input example, format and processing rules when citing a result, and verify the output. Keep keys and other sensitive material out of public examples.
- RFC 7292 — PKCS #12 Personal Information Exchange Syntax
- RFC 5280 — X.509 Certificate and CRL Profile
These references explain protocol or format rules; they do not endorse results produced by this site.