DER to PEM Converter

Overview

Convert a binary X.509 certificate, private key, public key or CSR to PEM text with the BEGIN and END lines that Apache, Nginx and OpenSSL expect. Paste PEM instead and it converts back to DER. Chains are converted block by block, and for a certificate you also see its subject, issuer and dates. It all runs in your browser, which matters here: these files often hold private keys.

Setting up a web serverYour CA sent a binary .cer, and Apache or Nginx needs PEM before the site will start.
Working with OpenSSLGet the PEM that OpenSSL, scripts and CI tools accept, ready to inspect or add to a bundle.
Moving a private keyConvert a DER RSA or EC key to PEM without handing it to an online service.
Submitting a CSRTurn a binary signing request from a device or script into the PEM text CA portals accept.
Identifying a mystery fileConvert an unlabeled .der and see the subject, issuer and dates, usually enough to tell what it is.

Guides

01 How to read what is actually in an SSL certificate

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 Hash Generator 06 JWT Sign

Specification

Command: security.der_to_pem
Set: Security
Input: MIXED
Output: MIXED
Max file: 10MB
Batch: single file

X-X509-CA-CERT OCTET-STREAM

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

Your file is opened, worked on and saved inside this tab. This tool has no upload step, so your file has nowhere else to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Add your file

Drop a .der, .cer or .crt file, or paste PEM to convert the other way.

Chains stay chains

Each block is converted in order, so a chain comes back complete.

Copy or download

You get PEM with the BEGIN and END lines OpenSSL, Nginx and Apache expect. For a certificate, you also see its details.

Frequently asked

Why convert DER to PEM?

Most Unix tools want PEM. Apache, Nginx and OpenSSL read it, and as text you can paste it into a config, combine files or compare them. Binary DER can't do that.

How can I tell if a file is DER?

Open it in a text editor. DER looks like gibberish, PEM starts with a line of dashes and the word BEGIN. File extensions don't tell you, since .cer and .crt are used for both. Or drop it here and the tool works it out.

Will the conversion change the certificate?

No. PEM is the same DER data in Base64 with header lines. Subject, dates, key, extensions and signature stay the same, so anything that verified before still verifies.

Can I convert any type of DER file?

Certificates, private keys, public keys and certificate signing requests all work. Each gets the BEGIN and END label that matches what it is, which servers and OpenSSL use to know how to read it.

Is it safe to convert my certificates here?

Yes. The file is converted in your browser, and nothing is uploaded or stored. That matters most when you're converting a private key.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/