CERTIFICATE WORKSHOP / FORMATS · 5 MIN READ

Convert Certificate Formats Without Losing the Key.

File extensions are hints, not proof of encoding. A successful conversion cannot create a missing private key, repair an issuer path or renew a certificate.

Format	Typical Contents	Important Distinction
PEM	Base64 text with BEGIN/END labels.	Can represent certificates or keys; inspect the label.
DER	Binary-encoded object.	A DER certificate contains no private key.
CER / CRT	Usually a certificate.	Either PEM or DER; the extension does not decide.
P7B / PKCS#7	Certificate chain container.	Does not carry the matching private key.
PFX / P12 / PKCS#12	Certificates and potentially private keys.	Treat as sensitive even when password-protected.

Run conversions on your own machine in a protected folder. Use different input and output filenames and keep a verified backup. OpenSSL may overwrite output files. Never use an online converter for private keys or PFX files.

PEM Certificate to Binary DER

OpenSSL / Certificate Only

openssl x509 -in leaf.pem -outform DER -out leaf.cer

Binary DER Certificate to PEM

OpenSSL / Certificate Only

openssl x509 -inform DER -in leaf.cer -out leaf.pem

If leaf.cer already begins with a PEM certificate label, do not force -inform DER. Renaming a file is not a conversion.

PKCS#7 Chain to PEM Certificates

OpenSSL / P7B to PEM

openssl pkcs7 -in chain.p7b -print_certs -out ca-certificates.pem

This assumes a PEM-encoded P7B. Add -inform DER for a binary P7B. The output contains public certificates, not a private key. Check which certificate is the leaf before using the file as a CA chain.

PEM CA Certificates to PKCS#7

OpenSSL / PEM to P7B

openssl crl2pkcs7 -nocrl -certfile ca-chain.pem -out chain.p7b

Extract Public Certificates from a PFX

Leaf Certificate / No Keys

openssl pkcs12 -in aboutssl.info.pfx -clcerts -nokeys -out leaf.pem

CA Certificates / No Keys

openssl pkcs12 -in aboutssl.info.pfx -cacerts -nokeys -out ca-certificates.pem

Both commands ask for the PFX password. The output can include bag metadata around PEM blocks. Check subjects and issuers; do not assume a file named “CA” contains the exact path your server needs.

Extract a Private Key Only When Required

Sensitive / Encrypted Key Output

openssl pkcs12 -in aboutssl.info.pfx -nocerts -aes256 -out recovered-key.encrypted.pem

The recovered PEM key is encrypted with a new passphrase you enter. Do not add -noenc or -nodes as a troubleshooting shortcut. Keep the key file restricted and remove temporary sensitive copies through your organization’s approved process.

Combine the Parts into One PFX

Follow the complete PFX recipe to verify key matching and the CA chain before packaging. For a key in the Windows certificate store, use the PowerShell export workflow.