01
Use content instead of the filename
Auto detection examines each input separately, so .crt and .cer can contain either encoding. Paste PEM only; add binary DER as a file. When mixing inputs, pasted blocks precede the added files.
SSL / TLS Certificates
Certificate converter
Paste PEM blocks or add certificate files. Choose PEM for a combined bundle, or DER for individual binary downloads.
Certificate converter
PEM certificates
Paste complete CERTIFICATE blocks. Binary DER belongs in the file picker. Pasted blocks come before added files.
Converted certificates
Certificates stay in this browser’s memory. Nothing is uploaded or saved in browser storage.
Encoding options
Up to 2 MiB total, 100 files and 100 certificates. All inputs must pass before export.
Parsing and conversion do not verify signatures, trust, expiry or hostnames.
Paste a certificate or choose a file.
A certificate converter helps when the receiving application asks for an encoding different from the file you received. Renaming a .cer file does not turn binary data into text. Inspect the actual content, keep the public certificate separate from its key, and check the number of certificates before handing the result to another system.
Why use this certificate converter
Change the wrapper, keep the certificate
This certificate converter preserves the original DER bytes. PEM to DER removes the text envelope; DER to PEM adds Base64 and certificate boundaries. Neither direction edits the public key, signature or signed certificate fields.
Keep the whole bundle visible
A PEM chain can contain more than the first certificate. Every accepted block appears in its original position, including duplicates. Download the selected item to split the bundle, or export all of them together as PEM.
Check content, order and the export target
02
Confirm the complete set
Compare the certificate count, subject and fingerprint with what you expected. The two-certificate example demonstrates splitting. A malformed second block blocks the whole export; it is never silently skipped.
03
Select before downloading
PEM exports the full bundle, while the selected-certificate action saves one item in the chosen target format. Turn automatic conversion off to use Convert or Ctrl/Cmd + Enter. Any input or format change disables old exports immediately.
Re-encode, combine and identify
Two encodings of the same object
Import one DER certificate per file or multiple labeled PEM blocks. The X.509 parser checks certificate structure before generating results. A string that merely happens to decode as Base64 is insufficient.
Ordered certificate bundles
Combine multiple local files and pasted blocks without deduplication or chain sorting. The output uses 64-character Base64 lines and LF endings. CRT to PEM follows the file content, not a guessed extension mapping.
Byte-level fingerprints
Each entry includes its DER length, serial number and SHA-256 fingerprint. Compare fingerprints before and after transfer to identify the exact certificate. The subject uses attribute OIDs so unfamiliar attributes are not renamed incorrectly.
What conversion does and does not change
- Public certificates only
- Accepts X.509 CERTIFICATE blocks and single DER certificate objects. Private keys, public-key-only files, CSRs, P12/PFX and PKCS#7/P7B are outside this version. There is no password field.
- No partial success
- Bad Base64, mismatched PEM boundaries, extra non-whitespace text, truncated DER and trailing binary bytes reject the batch. Fix the indicated source before exporting; the previous result remains disabled.
- One DER object per file
- A PEM certificate bundle may contain many blocks. DER export saves one selected certificate, never concatenated binary objects. Choose the PEM target for a single file carrying the complete bundle.
- Resource limits
- The total input limit is 2 MiB, with at most 100 files and 100 certificates. The parser also bounds nesting and node count. Large result lists initially show 50 entries; exports still include the complete accepted set.
- No chain or trust verification
- Order and duplicates are preserved. The tool does not repair a chain, fetch intermediates, validate signatures, check revocation or assess hostname coverage. An expired certificate can be re-encoded without becoming valid again.
Certificate converter questions
How do PEM and DER differ?
DER is the binary encoding of the certificate. PEM contains those bytes as Base64 between CERTIFICATE boundary lines. A matching fingerprint after a round trip confirms unchanged certificate bytes, even if line endings differ.
Can I convert a certificate without its private key?
Yes. Moving a public certificate between PEM and DER needs no private key. Do not add a key to complete this operation; key blocks are rejected rather than exported with the certificates.
When do I need a CA bundle?
A relying application may need intermediate certificates alongside the server certificate. You can combine the public certificates you already have into PEM. This tool neither fetches missing issuers nor determines the deployment order for you.
Which certificate formats are supported here?
PEM and DER are supported for X.509 certificates. The .crt and .cer suffixes can refer to either encoding. P7B and PFX are different containers, even when their contents include certificates.
How can I convert PEM to PFX?
That requires a PKCS#12 packaging tool and, for a server identity with a private key, the corresponding key and password handling. This version does not create or open PFX; first export your public certificates, then use a suitable local tool.
Is a certificate conversion case missing?
Prepare the format your application expects
Return to the certificate converter, confirm the source count, and download a PEM bundle or one DER certificate. Keep the original files until the receiving application has accepted the result.