OpenSSL "unable to load certificate": identify the real format

unable to load certificate means the file you passed to OpenSSL does not contain a PEM-encoded certificate where the command expects one. The certificate is usually fine; it is in another format (DER, PKCS#7, PKCS#12), the wrong file was used (a key or CSR), or the PEM text was damaged when copied.

Quick fix

Converting the file to PEM fixes most cases; its first bytes show the format.

Identify what the file is:

file cert.crt
head -c 64 cert.crt | xxd | head -3
grep -- "-----BEGIN" cert.crt

Then use the matching command:

The SSL converter explains each format and conversion.

Causes

1. The certificate is DER-encoded

Windows exports ("DER encoded binary X.509"), Java tools and some CAs deliver binary certificates, often with a .cer or .crt extension.

• Confirm: grep BEGIN finds nothing; openssl x509 -inform DER -in cert.crt -noout -subject works.
• Fix: convert to PEM with the command in the table.

2. It is a PKCS#7 bundle

.p7b / .p7c files carry certificates without keys and are common from Windows and some CA portals.

• Confirm: the file starts with -----BEGIN PKCS7-----, or is binary and openssl pkcs7 -inform DER -in file -print_certs works.
• Fix: extract with -print_certs, then put the leaf first and intermediates after it for web servers.

3. It is a PKCS#12 file

.pfx / .p12 files contain a key and certificates, protected by a password.

• Fix: openssl pkcs12 -in cert.pfx -nokeys -out chain.pem for certificates and -nocerts -nodes -out key.pem for the key. OpenSSL 3 may need -legacy for files created with old algorithms such as RC2.

4. The wrong file was used

A private key, CSR or a public key file passed to openssl x509 fails the same way.

• Confirm: grep BEGIN shows PRIVATE KEY, CERTIFICATE REQUEST or PUBLIC KEY.
• Fix: use the certificate file; for a CSR use openssl req -in file -noout -text.

5. Damaged PEM text

Copying from email, chat or a web page can add spaces, merge lines, strip the BEGIN/END lines, add a UTF-8 byte-order mark or Windows line endings.

• Confirm: cat -A cert.pem | head shows ^M or odd characters; the BEGIN line has extra dashes or spaces.
• Fix: run dos2unix, remove the BOM, make sure each line has 64 base64 characters, or download the file again.

6. "Expecting: TRUSTED CERTIFICATE"

This is how openssl x509 in OpenSSL 1.1.1 names the PEM type it was looking for when it found nothing usable. It also accepts plain BEGIN CERTIFICATE blocks, so the message does not mean you need a special "trusted" certificate; one of the causes above applies.

Fixes by environment

Convert the file to PEM once; every tool below can also export PEM directly.

Windows: in the certificate export wizard choose "Base-64 encoded X.509 (.CER)" to get PEM directly.

Java: keytool -exportcert -rfc -alias name -keystore store.jks writes PEM; without -rfc it writes DER.

Nginx / Apache: they require PEM. Convert first, then point ssl_certificate / SSLCertificateFile at the PEM chain.

Kubernetes: TLS Secrets expect base64 of PEM data; base64-encoding a DER file produces a Secret that controllers cannot load.

Don't do this

• Rename the file to .pem and expect it to work. The extension does not change the encoding.
• Regenerate the key and certificate because one file will not load. Convert the existing files instead; reissuing is rarely necessary.
• Send a .pfx and its password through the same channel. It contains the private key.