Format Converter
PEM to DER, DER to PEM, and PKCS#7 bundles unpacked into individual certificates.
What this tool does
Converts certificates between the encodings different tools insist on: PEM to DER, DER to PEM, and PKCS#7 bundles to individual PEM certificates. Everything is re-framed in your browser; no file is uploaded.
PEM is base64 text with BEGIN/END lines — the form you can paste. DER is the same bytes unencoded, used where a binary blob is expected. PKCS#7 (.p7b) bundles a chain with no keys, and is what many commercial CAs hand back.
How to use it
Pick a mode, then supply either a file or pasted text:
- PEM to DER — paste the PEM, download the binary.
- DER to PEM — upload the
.der/.cerfile, or paste hex, and choose the header to wrap it with. - PKCS#7 to PEM — upload a
.p7band get each certificate separately, decoded and downloadable.
Reading the result
Extracted certificates are shown with their subject and issuer, so you can tell the leaf from the intermediates. Order matters when you build a chain file: leaf first, then each intermediate toward the root.
Common problems
- A .pfx that will not open. Files written before about 2019 use 3DES or RC2 encryption, which the browser's Web Crypto API does not implement. Re-export it with modern encryption first:
openssl pkcs12 -in old.pfx -nodes -out tmp.pem, thenopenssl pkcs12 -export -in tmp.pem -out new.pfx. To build a .pfx rather than open one, use the PEM to PFX builder. - "Not a PKCS#7 SignedData blob". The file is probably a plain certificate with a
.p7bextension. Try the certificate decoder. - "That doesn't look like hex". Binary content was pasted as text. Use the file picker instead.