CRT to PEM converter
Convert a .crt or .cer file to PEM, whether it holds binary DER or PEM text. The file stays in your browser.
Runs in your browser Private keys are generated and processed in your browser (WebCrypto) and never leave your device. Nothing is uploaded to ssl.sh.
The CRT to PEM converter turns .crt and .cer files into PEM. Paste the content or choose the file and press Convert: DER input is converted, and PEM input is cleaned up and put in chain order. Everything runs in your browser.
Why .crt files cause trouble
Certificate file extensions are conventions, not formats. CAs, Windows and Java tools all write .crt and .cer, some as PEM and some as binary DER. Servers on Linux expect PEM, so a DER file named .crt fails with errors such as PEM_read_bio_X509_AUX ... no start line in nginx.
Steps
- Choose the
.crtor.cerfile (or paste PEM text). - Press Convert.
- Download the
.pemfile and use it in your server configuration. If you also have intermediates, put them after the leaf in the same file.
Equivalent OpenSSL commands
# find out what you have
openssl x509 -in certificate.crt -noout -subject 2>/dev/null && echo PEM || echo "not PEM, try DER"
# DER .crt → PEM
openssl x509 -inform DER -in certificate.crt -out certificate.pem
To read the certificate's fields, open it in the certificate decoder.
FAQ
Can I rename certificate.crt to certificate.pem?
Only if it already contains PEM text (it starts with -----BEGIN CERTIFICATE-----). If it is binary DER, renaming does nothing and servers fail to load it.
Nginx says 'PEM_read_bio_X509_AUX failed' or 'no start line'. Is this the fix?
Often, yes: that error appears when nginx reads a DER file or a file with extra text. Convert the .crt here and point ssl_certificate to the PEM output.
My .crt contains several certificates. Is that fine?
Yes, if it is PEM. The converter keeps all of them and orders them leaf first, which is what servers expect.