# OpenSSL "unable to load certificate": identify the real format

> OpenSSL says unable to load certificate when the file is not a PEM certificate: DER, PKCS#7, PKCS#12, a key or a damaged paste. How to detect and convert it.

Source: https://ssl.sh/errors/openssl-unable-to-load-certificate/
Last updated: 2026-11-10

**`unable to load certificate` means the file you passed to OpenSSL does not contain a [PEM](https://ssl.sh/glossary/pem/)-encoded certificate where the command expects one.** The certificate is usually fine; it is in another format ([DER](https://ssl.sh/glossary/der/), PKCS#7, [PKCS#12](https://ssl.sh/glossary/pkcs12/)), the wrong file was used (a key or CSR), or the PEM text was damaged when copied.

## Quick fix

Converting the file to PEM fixes most cases; its first bytes show the format.

Identify what the file is:

```bash
file cert.crt
head -c 64 cert.crt | xxd | head -3
grep -- "-----BEGIN" cert.crt
```

Then use the matching command:

| What you see | Format | Command |
|---|---|---|
| `-----BEGIN CERTIFICATE-----` | PEM certificate | check for damage (below) |
| binary, starts `30 82` | DER certificate | `openssl x509 -inform DER -in cert.crt -out cert.pem` |
| `-----BEGIN PKCS7-----` or a `.p7b` | PKCS#7 bundle | `openssl pkcs7 -print_certs -in cert.p7b -out chain.pem` |
| binary `.pfx` / `.p12` | PKCS#12 | `openssl pkcs12 -in cert.pfx -nokeys -out chain.pem` |
| `BEGIN PRIVATE KEY` / `CERTIFICATE REQUEST` | not a certificate | use the right file |

The [SSL converter](https://ssl.sh/tools/ssl-converter/) explains each format and conversion.

## Causes

### 1. The certificate is DER-encoded

Windows exports ("DER encoded binary X.509"), Java tools and some CAs deliver binary certificates, often with a `.cer` or `.crt` extension.

- **Confirm:** `grep BEGIN` finds nothing; `openssl x509 -inform DER -in cert.crt -noout -subject` works.
- **Fix:** convert to PEM with the command in the table.

### 2. It is a PKCS#7 bundle

`.p7b` / `.p7c` files carry certificates without keys and are common from Windows and some CA portals.

- **Confirm:** the file starts with `-----BEGIN PKCS7-----`, or is binary and `openssl pkcs7 -inform DER -in file -print_certs` works.
- **Fix:** extract with `-print_certs`, then put the leaf first and intermediates after it for web servers.

### 3. It is a PKCS#12 file

`.pfx` / `.p12` files contain a key and certificates, protected by a password.

- **Fix:** `openssl pkcs12 -in cert.pfx -nokeys -out chain.pem` for certificates and `-nocerts -nodes -out key.pem` for the key. OpenSSL 3 may need `-legacy` for files created with old algorithms such as RC2.

### 4. The wrong file was used

A private key, CSR or a public key file passed to `openssl x509` fails the same way.

- **Confirm:** `grep BEGIN` shows `PRIVATE KEY`, `CERTIFICATE REQUEST` or `PUBLIC KEY`.
- **Fix:** use the certificate file; for a CSR use `openssl req -in file -noout -text`.

### 5. Damaged PEM text

Copying from email, chat or a web page can add spaces, merge lines, strip the `BEGIN`/`END` lines, add a UTF-8 byte-order mark or Windows line endings.

- **Confirm:** `cat -A cert.pem | head` shows `^M` or odd characters; the `BEGIN` line has extra dashes or spaces.
- **Fix:** run `dos2unix`, remove the BOM, make sure each line has 64 base64 characters, or download the file again.

### 6. "Expecting: TRUSTED CERTIFICATE"

This is how `openssl x509` in OpenSSL 1.1.1 names the PEM type it was looking for when it found nothing usable. It also accepts plain `BEGIN CERTIFICATE` blocks, so the message does not mean you need a special "trusted" certificate; one of the causes above applies.

## Fixes by environment

Convert the file to PEM once; every tool below can also export PEM directly.

**Windows:** in the certificate export wizard choose "Base-64 encoded X.509 (.CER)" to get PEM directly.

**Java:** `keytool -exportcert -rfc -alias name -keystore store.jks` writes PEM; without `-rfc` it writes DER.

**Nginx / Apache:** they require PEM. Convert first, then point `ssl_certificate` / `SSLCertificateFile` at the PEM chain.

**Kubernetes:** TLS Secrets expect base64 of PEM data; base64-encoding a DER file produces a Secret that controllers cannot load.

## Don't do this

- **Rename the file to `.pem` and expect it to work.** The extension does not change the encoding.
- **Regenerate the key and certificate because one file will not load.** Convert the existing files instead; reissuing is rarely necessary.
- **Send a `.pfx` and its password through the same channel.** It contains the private key.