Certificate format converter — PEM, DER, PFX, PKCS#8

An online converter for certificates and private keys. It reads PEM, DER, PKCS#1, PKCS#8, SEC1, encrypted keys and PKCS#12 bundles, works out what you gave it without being told, and offers only the conversions that make sense for that input. Everything runs in your browser through the WebCrypto API and a hand-written ASN.1 layer.

How to use it

1
Give it the file

Paste the text or drop the file. Several files at once are merged, which is how you build a PFX from a separate certificate, key and CA file.

2
Enter a password if the file is protected

The field appears only when the input turns out to be encrypted.

3
Pick the target format

Only the conversions that apply to your input are offered; the rest are greyed out.

4
Download

Text formats can be copied. DER and PFX are binary — use the download button, since copying the hex will not give you a working file.

Drop in whatever you have and take out the format your server wants

Paste above, drop files anywhere on this box, or

What it does

Opens the .pfx files other web tools cannot
Bundles exported from Windows and older Java use RC2-40 and 3DES, which the browser crypto API does not implement — so browser-based converters reject exactly the files people most often need to open. Those ciphers are implemented here, verified byte-for-byte against openssl.
Identifies the input by structure
No "choose your input format" dropdown to get wrong. A DER certificate, a PKCS#8 key and a PFX are distinguishable by shape, so the tool reads what you gave it and tells you what it found.
Every direction that matters
PEM to DER and back, PKCS#1 and SEC1 to PKCS#8 and back, extracting the key and certificates from a PFX, building a PFX from a key and its chain, encrypting or decrypting a key, and pulling the public key out of either a key or a certificate.
Two PFX compatibility profiles
Modern (AES-256 with PBKDF2-SHA256) for current software, or Compatible (3DES and RC2-40) for old Java, old Android and appliances that report a modern bundle as a wrong password.
Byte-identical to openssl
Format conversion is verified against openssl in the test suite: a key converted here has the same bytes openssl would produce, and openssl opens the bundles and encrypted keys this tool writes.

Frequently asked questions

Why do other online converters fail on my .pfx?

Because they are built on the browser's WebCrypto API, which implements AES but neither RC2 nor 3DES. Bundles exported by Windows, IIS and older Java keytool are encrypted with exactly those two algorithms, so a WebCrypto-only tool cannot decrypt them and usually reports a wrong password. Those ciphers are implemented directly here, so a .pfx from 2018 opens the same as one made this morning.

What is the difference between PEM and DER?

They hold identical data. DER is the raw binary encoding; PEM is that same binary in base64 with a "-----BEGIN …-----" header around it. Windows and Java tools tend to produce DER, with the extensions .der or .cer; Unix software wants PEM. Converting between them changes the wrapper only, never the certificate.

PKCS#1 or PKCS#8 — which does my server want?

Both nginx and Apache read either. PKCS#8 ("BEGIN PRIVATE KEY") is the modern default and what Java, Go and .NET expect. PKCS#1 ("BEGIN RSA PRIVATE KEY") is the older RSA-only form. If software rejects your key without saying why, converting between the two is worth trying — it is a common cause.

Can I build a .pfx for IIS from a Let's Encrypt certificate?

Yes. Drop in fullchain.pem and privkey.pem together, choose PFX, and set a password. Use the Modern profile for Windows 10 or Server 2016 and newer; if the import fails with a password error on something older, try the Compatible profile.

My .pfx has no password. Will it open?

Yes. There is a long-standing ambiguity in how an empty password is encoded — OpenSSL and some Java versions disagree — and a file written under one convention will not open under the other. Both are tried here, so an empty-password bundle opens either way.

You May Also Like

📝 CSR generator ⛓️ Certificate chain fixer 🔗 Key and certificate matcher 🧰 Let’s Encrypt troubleshooter 🔐 SSL Checker 📜 SSL certificate decoder 🏷️ Self-signed certificate generator

How do you rate this tool?

Thank you for your rating!
Want to share more? Leave a comment!
Thank you! Your comment will appear after moderation.
Who is this tool for?
💻 Developers & IT Pros
Published Updated Author: