PEM to DER converter
Convert PEM text (BEGIN/END blocks) into binary DER files, one per certificate, key or CSR. Runs locally in your browser.
Runs in your browser Private keys are generated and processed in your browser (WebCrypto) and never leave your device. Nothing is uploaded to ssl.sh.
The PEM to DER converter turns PEM-encoded objects into binary DER. Paste one or more PEM blocks (or choose a .pem file) and press Convert; each certificate, key or CSR is offered as its own .der download. Nothing is uploaded.
When you need DER
- Installing a CA certificate on Android or some Linux-based devices that only accept DER.
- Java
keytool -importcertaccepts both, but some older tools and appliances require DER. - Embedding a certificate in firmware or an IoT SDK as a byte array.
- Windows "Certificate Export Wizard" style workflows that expect
.cerbinary files.
Steps
- Paste PEM text, for example a block starting with
-----BEGIN CERTIFICATE-----. - Press Convert.
- Download each DER file. Certificates are named after their Common Name.
Equivalent OpenSSL commands
openssl x509 -in cert.pem -outform DER -out cert.der
openssl req -in request.csr -outform DER -out request.der
openssl pkey -in privkey.pem -outform DER -out privkey.der
Tips
- To check the result, open the
.derfile in the certificate decoder; it reads DER directly. - For a C array,
xxd -i cert.derprints the bytes ready to paste into source code.
FAQ
Why do I get several files?
DER has no way to store more than one object per file. Each PEM block (leaf, each intermediate, key) becomes its own DER file. Use PFX or P7B if you need one file for a whole chain.
Should the file end in .der or .cer?
Both are common for DER certificates. Windows associates .cer with its certificate viewer and opens both DER and PEM .cer files.
Does an encrypted PEM key stay encrypted?
Yes. An ENCRYPTED PRIVATE KEY block becomes an encrypted PKCS #8 DER file; the password is unchanged.