# DER to PEM Converter: Binary Certificate to Base64 Text

> Convert a binary DER certificate (.der, .cer, .crt), key, CSR or DER .p7b to PEM text in your browser; the type is detected.

Source: https://ssl.sh/tools/ssl-converter/der-to-pem/
Last updated: 2026-11-10

Turn a binary DER certificate, key or CSR into PEM text with BEGIN/END lines. The file never leaves your browser.

The DER to PEM converter turns binary DER files into PEM text. Choose a `.der`, `.cer` or `.crt` file and press **Convert**; the tool recognises what the file contains and shows it as PEM, ready to copy or download. Conversion happens in your browser.

## When you need DER to PEM

- You downloaded an intermediate certificate from the **CA Issuers** URL in a certificate. CAs serve these as DER (`application/pkix-cert`).
- Windows exported a certificate as "DER encoded binary X.509 (.CER)".
- A Java or hardware appliance produced a DER key or CSR.

## Steps

1. Choose the DER file.
2. Press **Convert**.
3. Copy the PEM text or download it. Append intermediates to your `fullchain.pem` after the leaf certificate.

## Equivalent OpenSSL commands

```bash
openssl x509 -inform DER -in cert.der -out cert.pem          # certificate
openssl req  -inform DER -in request.der -out request.csr     # CSR
openssl pkey -inform DER -in key.der -out key.pem             # private key
```

## Common errors

- **"Could not recognise this binary file"**: it may be a PFX (use [PFX to PEM](https://ssl.sh/tools/ssl-converter/pfx-to-pem/)) or not a certificate at all.
- **The PEM output has the wrong header**: software is strict about `BEGIN CERTIFICATE` vs `BEGIN TRUSTED CERTIFICATE`; this tool writes standard headers.


## FAQ

**How can I tell whether a file is DER or PEM?**

Open it in a text editor. PEM starts with -----BEGIN and is readable Base64; DER looks like random binary characters. The extension (.cer, .crt) does not tell you.

**Does converting change the certificate?**

No. PEM is only a Base64 wrapper around the DER bytes; fingerprints and signatures stay the same.

**Can I convert a DER private key?**

Yes. PKCS #8, PKCS #1 RSA and SEC 1 EC keys in DER are detected and written as PRIVATE KEY, RSA PRIVATE KEY or EC PRIVATE KEY PEM blocks.