# P7B to PEM Converter: Extract Certificates from PKCS #7

> Extract certificates from a .p7b/.p7c PKCS #7 bundle (PEM or DER) as PEM in chain order, in your browser.

Source: https://ssl.sh/tools/ssl-converter/p7b-to-pem/
Last updated: 2026-11-10

Extract the certificates from a .p7b/.p7c bundle and get them as PEM, leaf first. Runs in your browser.

The P7B to PEM converter extracts every certificate from a PKCS #7 bundle. Paste a `-----BEGIN PKCS7-----` block or choose a `.p7b`/`.p7c` file (PEM or DER) and press **Convert**. You get every certificate as PEM in chain order, ready to use as a full chain. The conversion runs in your browser.

## When you need it

- Your CA or reseller delivered the certificate as `.p7b`, typical for IIS-oriented downloads.
- You exported a chain from Windows with "Include all certificates in the certification path" (Cryptographic Message Syntax Standard – PKCS #7).
- A Java keystore export or appliance produced a `.p7c` file.

## Steps

1. Paste the PKCS #7 text or choose the file.
2. Press **Convert**.
3. Copy the PEM output. Remove the root certificate if it is included and you only need the server chain.

## Equivalent OpenSSL commands

```bash
openssl pkcs7 -print_certs -in certs.p7b -out certs.pem
openssl pkcs7 -inform DER -print_certs -in certs.p7b -out certs.pem   # DER-encoded file
```

`-print_certs` also prints `subject=` and `issuer=` lines above each certificate; most servers ignore them, but some control panels reject them, which is why this tool outputs clean PEM.

## Next steps

Pair the PEM chain with your private key in [PEM to PFX](https://ssl.sh/tools/ssl-converter/pem-to-pfx/) for Windows, or install it directly on Nginx or Apache. Verify the order with the [certificate decoder](https://ssl.sh/tools/certificate-decoder/).


## FAQ

**Where is the private key in my P7B?**

There is none: PKCS #7 certificate bundles never contain keys. The key is on the machine where the CSR was created. To make a PFX, combine the PEM certificates from this page with that key.

**Why are the certificates in a different order than in the file?**

PKCS #7 stores certificates as an unordered set, and many files list the root first. Servers must send the leaf first, so the converter reorders them.

**Should I keep the root certificate?**

For server configuration, no: send the leaf and intermediates only. Keep the root if you need to install it in a trust store.