P7B to PEM converter
Extract the certificates from a .p7b/.p7c bundle and get them as PEM, leaf first. Runs in your browser.
Runs in your browser Private keys are generated and processed in your browser (WebCrypto) and never leave your device. Nothing is uploaded to ssl.sh.
The P7B to PEM converter extracts every certificate from a PKCS #7 bundle. Paste a -----BEGIN PKCS7----- block or choose a .p7b/.p7c file (PEM or DER) and press Convert. You get every certificate as PEM in chain order, ready to use as a full chain. The conversion runs in your browser.
When you need it
- Your CA or reseller delivered the certificate as
.p7b, typical for IIS-oriented downloads. - You exported a chain from Windows with "Include all certificates in the certification path" (Cryptographic Message Syntax Standard – PKCS #7).
- A Java keystore export or appliance produced a
.p7cfile.
Steps
- Paste the PKCS #7 text or choose the file.
- Press Convert.
- Copy the PEM output. Remove the root certificate if it is included and you only need the server chain.
Equivalent OpenSSL commands
openssl pkcs7 -print_certs -in certs.p7b -out certs.pem
openssl pkcs7 -inform DER -print_certs -in certs.p7b -out certs.pem # DER-encoded file
-print_certs also prints subject= and issuer= lines above each certificate; most servers ignore them, but some control panels reject them, which is why this tool outputs clean PEM.
Next steps
Pair the PEM chain with your private key in PEM to PFX for Windows, or install it directly on Nginx or Apache. Verify the order with the certificate decoder.
FAQ
Where is the private key in my P7B?
There is none: PKCS #7 certificate bundles never contain keys. The key is on the machine where the CSR was created. To make a PFX, combine the PEM certificates from this page with that key.
Why are the certificates in a different order than in the file?
PKCS #7 stores certificates as an unordered set, and many files list the root first. Servers must send the leaf first, so the converter reorders them.
Should I keep the root certificate?
For server configuration, no: send the leaf and intermediates only. Keep the root if you need to install it in a trust store.