# SSL Converter: PEM, DER, PFX/P12, P7B and CRT Online

> Convert certificates in your browser: PEM ↔ DER, PEM + key → PFX, PFX → PEM, P7B → PEM, CRT → PEM. Keys are never uploaded.

Source: https://ssl.sh/tools/ssl-converter/
Last updated: 2026-11-10

Convert certificates and keys between PEM, DER, PFX/PKCS #12 and P7B. Everything happens in your browser; private keys are never uploaded.

The SSL converter changes certificates and private keys from one format to another without installing OpenSSL. Pick a mode (for example **PEM → PFX**), paste the text or choose the file, and download the result. All conversions run in your browser with JavaScript; certificates and keys are not uploaded anywhere.

## How to use it

1. Choose the conversion at the top. Each mode also has its own page with details, linked below the tool.
2. Paste PEM text or choose a file. For PFX files, enter the password.
3. Press **Convert** (Create PFX in PEM → PFX mode) and download the files.

## Modes

- **PEM → DER**: each PEM block (certificate, key or CSR) becomes a binary `.der` file, one object per file.
- **DER → PEM**: a binary certificate, key, CSR or DER `.p7b` becomes PEM text.
- **PEM → PFX**: certificate, chain and private key are bundled into a password-protected `.pfx`. The tool checks that the key matches the certificate and orders the chain. See [PEM to PFX](https://ssl.sh/tools/ssl-converter/pem-to-pfx/).
- **PFX → PEM**: a `.pfx`/`.p12` is unpacked into `fullchain.pem`, `cert.pem`, `chain.pem` and `privkey.pem`. See [PFX to PEM](https://ssl.sh/tools/ssl-converter/pfx-to-pem/).
- **P7B → PEM**: certificates are extracted from a PKCS #7 bundle and put in chain order.
- **CRT → PEM**: a `.crt` or `.cer` file of either encoding becomes PEM.

## Equivalent OpenSSL commands

```bash
# PEM → DER
openssl x509 -in cert.pem -outform DER -out cert.der
# PEM + key → PFX
openssl pkcs12 -export -out site.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem
# PFX → PEM (add -legacy on OpenSSL 3 for old RC2-encrypted files)
openssl pkcs12 -in site.pfx -nodes -out all.pem
# P7B → PEM
openssl pkcs7 -print_certs -in certs.p7b -out certs.pem
```

## Notes

- A PFX holds the private key: always set a strong password and delete copies you no longer need.
- `privkey.pem` from PFX → PEM is unencrypted, because web servers need it that way. Protect it with file permissions.
- DER can hold only one object per file; a chain needs several files or a PEM/P7B bundle.


## FAQ

**Which format does my server need?**

Nginx, Apache, HAProxy, Caddy and most Linux software use PEM files. IIS, Windows, Azure App Service and many Java servers import PFX/P12. Some Java tools and Windows dialogs offer P7B for chains without keys.

**Is it safe to put a private key into an online converter?**

Only if the conversion runs locally. This converter is JavaScript running in your browser: the key is read from the text box or file, converted in memory and offered as a download, and it is never sent to ssl.sh. You can disconnect from the network after the page has loaded to confirm.

**Windows says the PFX password is wrong, but it is right. Why?**

Older Windows versions such as Windows Server 2016 cannot read PFX files that use AES-256 and an SHA-256 MAC. Recreate the PFX with the compatibility (3DES + SHA-1) option.

**What is the difference between .crt, .cer and .pem?**

Only the file extension. .crt and .cer files contain either PEM text or DER binary. The CRT to PEM mode detects which and outputs PEM.