SSL Converter: Convert PEM, DER and PFX Free

An SSL converter changes a certificate file from one format to another so the server or app you are using can read it. This free tool converts PEM to DER, DER to PEM, PEM to PFX and PFX to PEM. Upload a file up to 2 MB, pick the target format, and download the result.

What Are SSL Certificate Formats?

SSL certificate formats are different ways of storing the same certificate data in a file. The certificate does not change, only the packaging does. That is why a file that works on one server can fail on another that expects a different format.

Most certificates sold as SSL certificates are used for TLS, the newer protocol, but they are still called SSL certificates and follow the same X.509 standard. The three formats this page handles are listed below.

PEM vs DER

PEM is Base64 text wrapped in lines such as -----BEGIN CERTIFICATE-----, so you can open it in any text editor. DER holds the same data as raw binary, so a text editor shows unreadable characters.

What makes PFX different?

A PFX (also called PKCS#12) file bundles the certificate, its private key and optionally the intermediate chain into one password-protected file. Windows and IIS prefer it because you import everything in a single step.

How to Use the SSL Converter

You convert a certificate in a few steps: upload the file, confirm the formats, add extra files if you are building a PFX, and click the button.

1. Click the "Certificate File" area or drag and drop your file onto it. The page lists .pem, .der, .crt, .cer, .pfx, .p12 and .p7b, with a 2 MB maximum.
2. Check "Current Format". The tool auto-detects it from the file extension (.pfx and .p12 become PFX / PKCS#12, .pem, .crt, .cer and .key become Standard PEM, .der becomes DER / Binary). Change it if the detection is wrong.
3. Choose the "Target Format": Standard PEM, DER / Binary or PFX / PKCS#12.
4. For a PFX output, upload the "Private Key File" (required), then optionally add "Chain Certificate" and "Chain Certificate 2". Type a "PFX Password" to protect the new file. Use the eye button to show or hide what you type.
5. For a PFX input, enter the "PFX Password" that was set when the file was created.
6. Click "Convert Certificate".
7. When "Certificate Converted Successfully" appears, check the Source Format and Output Format, then click "Download Converted File". Use "Convert Another" to start over.

Worked Example: Convert a CRT File to PFX for IIS

To convert a CRT file to PFX, you need the certificate, its private key and ideally the intermediate certificate from your authority. Here is a realistic case.

Your certificate authority sends example-com.crt and intermediate.crt. You generated example-com.key earlier. Your new host runs IIS, which wants a single PFX file.

• Upload example-com.crt as the certificate file. The Current Format switches to Standard PEM.
• Set Target Format to PFX / PKCS#12. The private key, chain and password fields appear.
• Upload example-com.key as the private key and intermediate.crt as Chain Certificate.
• Enter a strong PFX Password and click Convert Certificate.

The result page reads "Converted from PEM to PFX/PKCS#12". Download the file and import it in Windows with the password you chose.

The reverse also works. Upload backup.pfx, leave the format as PFX / PKCS#12, set the target to Standard PEM, enter its password and convert. You get a PEM file you can use on a Linux server.

How Do You Read the Result and Fix Problems?

A successful run shows a summary with the Source Format and the Output Format, plus a download link. Confirm both match what you intended before you deploy the file.

If something goes wrong, the page shows one of these messages:

• Please select a certificate file to convert. No file was chosen. Add one and try again.
• File size exceeds the 2 MB limit. A single certificate is normally a few kilobytes, so a file this large is probably an archive or the wrong file.
• Conversion failed! The most common causes are a wrong Current Format, a PEM file with no certificate block inside, a missing or mismatched private key, a wrong PFX password, or choosing the same format for source and target.
• CSR warning. A .csr file is a signing request, not a certificate. Send it to your certificate authority to get a certificate back.

When a conversion fails, start with the format. A .cer file can be PEM or DER, so the auto-detection assumes PEM and may guess wrong. Open the file in a text editor: readable text with BEGIN CERTIFICATE means PEM, and garbled characters mean DER.

When Should You Convert a Certificate?

You convert a certificate whenever the system that needs it expects a different format than the one your authority delivered. These are the usual situations.

• Moving from Linux to Windows. Combine a PEM certificate, key and chain into one PFX for IIS.
• Moving from Windows to Linux. Turn an exported PFX into PEM for Apache or Nginx.
• Java or similar platforms. Change a PEM certificate to DER when the application asks for binary input.
• Inspecting a binary file. Turn a DER file into PEM so you can read, copy or paste it.
• Fixing a rejected upload. A control panel that refuses your file often just wants a different format.

Note that a .crt file from your authority is usually already PEM. If it opens as text with BEGIN CERTIFICATE, you only need to rename it to .pem, no conversion required.

Best Practices and Common Mistakes

Careful preparation prevents most failed conversions and broken installs.

• Keep your originals. The converter creates a new file, so store the source files safely until the new one works.
• Use the matching private key. A PFX built with the wrong key is useless. Run the pair through a certificate key matcher first.
• Add the intermediate certificate. Without the chain, some browsers and apps report an incomplete trust path. Use the two chain fields for your intermediate certificates.
• Pick a real password. A PFX holds your private key, so avoid short or reused passwords, and share it separately from the file.
• Convert one certificate per file. Upload a single certificate, not a combined file with several pasted together.
• Do not upload a CSR. If you still need a request and key, generate a new CSR and send it to your authority.

Verify after converting

Open the converted PEM in a certificate decoder to confirm the domain, issuer and expiry date survived the conversion. After you install it on a live site, run an SSL checker to confirm the chain and expiry look right to visitors.

What Are the Limits of This Converter?

This converter does four conversions: PEM to DER, DER to PEM, PEM to PFX and PFX to PEM. Other routes are not offered as a single step.

• To go from DER to PFX, convert DER to PEM first, then PEM to PFX with your key.
• PKCS#7 (.p7b) files can be selected but are not available as a source or target in the format menus.
• Files over 2 MB are rejected.
• The tool changes the format only. It does not renew, reissue or validate a certificate, and it cannot tell you whether the certificate is trusted or expired.

Format detection relies on the file name, so a wrongly named file needs the Current Format set by hand.

Use the converter on this page whenever a server, panel or app rejects your certificate file. Upload it, choose the target format, add the key if you are building a PFX, and download a file that works. For more utilities that help with keys, requests and certificates, browse the security and encryption tools.