DER to PEM converter
Turn a binary DER certificate, key or CSR into PEM text with BEGIN/END lines. The file never leaves your browser.
Runs in your browser Private keys are generated and processed in your browser (WebCrypto) and never leave your device. Nothing is uploaded to ssl.sh.
The DER to PEM converter turns binary DER files into PEM text. Choose a .der, .cer or .crt file and press Convert; the tool recognises what the file contains and shows it as PEM, ready to copy or download. Conversion happens in your browser.
When you need DER to PEM
- You downloaded an intermediate certificate from the CA Issuers URL in a certificate. CAs serve these as DER (
application/pkix-cert). - Windows exported a certificate as "DER encoded binary X.509 (.CER)".
- A Java or hardware appliance produced a DER key or CSR.
Steps
- Choose the DER file.
- Press Convert.
- Copy the PEM text or download it. Append intermediates to your
fullchain.pemafter the leaf certificate.
Equivalent OpenSSL commands
openssl x509 -inform DER -in cert.der -out cert.pem # certificate
openssl req -inform DER -in request.der -out request.csr # CSR
openssl pkey -inform DER -in key.der -out key.pem # private key
Common errors
- "Could not recognise this binary file": it may be a PFX (use PFX to PEM) or not a certificate at all.
- The PEM output has the wrong header: software is strict about
BEGIN CERTIFICATEvsBEGIN TRUSTED CERTIFICATE; this tool writes standard headers.
FAQ
How can I tell whether a file is DER or PEM?
Open it in a text editor. PEM starts with -----BEGIN and is readable Base64; DER looks like random binary characters. The extension (.cer, .crt) does not tell you.
Does converting change the certificate?
No. PEM is only a Base64 wrapper around the DER bytes; fingerprints and signatures stay the same.
Can I convert a DER private key?
Yes. PKCS #8, PKCS #1 RSA and SEC 1 EC keys in DER are detected and written as PRIVATE KEY, RSA PRIVATE KEY or EC PRIVATE KEY PEM blocks.