# CRT to PEM Converter: .crt and .cer Files to PEM

> Convert .crt and .cer certificate files to PEM in your browser. Detects whether the file is DER binary or already PEM, and handles PKCS #7 content.

Source: https://ssl.sh/tools/ssl-converter/crt-to-pem/
Last updated: 2026-11-10

Convert a .crt or .cer file to PEM, whether it holds binary DER or PEM text. The file stays in your browser.

The CRT to PEM converter turns `.crt` and `.cer` files into PEM. Paste the content or choose the file and press **Convert**: DER input is converted, and PEM input is cleaned up and put in chain order. Everything runs in your browser.

## Why .crt files cause trouble

Certificate file extensions are conventions, not formats. CAs, Windows and Java tools all write `.crt` and `.cer`, some as PEM and some as binary DER. Servers on Linux expect PEM, so a DER file named `.crt` fails with errors such as `PEM_read_bio_X509_AUX ... no start line` in nginx.

## Steps

1. Choose the `.crt` or `.cer` file (or paste PEM text).
2. Press **Convert**.
3. Download the `.pem` file and use it in your server configuration. If you also have intermediates, put them after the leaf in the same file.

## Equivalent OpenSSL commands

```bash
# find out what you have
openssl x509 -in certificate.crt -noout -subject 2>/dev/null && echo PEM || echo "not PEM, try DER"
# DER .crt → PEM
openssl x509 -inform DER -in certificate.crt -out certificate.pem
```

To read the certificate's fields, open it in the [certificate decoder](https://ssl.sh/tools/certificate-decoder/).


## FAQ

**Can I rename certificate.crt to certificate.pem?**

Only if it already contains PEM text (it starts with -----BEGIN CERTIFICATE-----). If it is binary DER, renaming does nothing and servers fail to load it.

**Nginx says 'PEM_read_bio_X509_AUX failed' or 'no start line'. Is this the fix?**

Often, yes: that error appears when nginx reads a DER file or a file with extra text. Convert the .crt here and point ssl_certificate to the PEM output.

**My .crt contains several certificates. Is that fine?**

Yes, if it is PEM. The converter keeps all of them and orders them leaf first, which is what servers expect.