Convert certificates between PEM, DER, PKCS#12/PFX and PKCS#7/P7B — everything runs locally, private keys and passwords never leave your browser
Paste a PEM certificate (-----BEGIN CERTIFICATE-----) to convert it to binary DER. With a chain, the first certificate is converted.
Different servers want different certificate formats: Nginx and Apache read PEM, Windows / IIS want a PKCS#12 .pfx bundle, and Java keystores often expect PKCS#7 .p7b. This tool converts between all of them in your browser — PEM ↔ DER, PEM → .pfx and back, and PEM ↔ .p7b — so you never have to remember the openssl incantations.
Everything runs client-side with pkijs and node-forge. Private keys and the passwords you type to build or open a .pfx are processed entirely in the browser and are never uploaded — you can confirm it in your browser's Network panel.
No. All conversions, including building and opening PKCS#12 .pfx files, happen in your browser with node-forge. The private key and the PFX password never leave your device and no network request is made.
Choose PEM → PKCS#12, paste your certificate and its private key (and any chain certificates), set an export password, and download the .pfx. The result can be imported into IIS or read with openssl pkcs12 -info.
Choose PKCS#12 → PEM, upload the .pfx/.p12, and enter its password. The tool splits out the private key, the leaf certificate and any chain certificates as separate PEM files.
Yes. PEM and DER are just two encodings of the same certificate bytes, so pem → der → pem is byte-for-byte stable. PKCS#12 export currently supports RSA keys.