Browser 106

max 10MB

Inspector security/der-to-pem

DER to PEM Converter

Overview

DER to PEM rewraps a binary X.509 certificate, private key, public key or CSR as Base64 text with the BEGIN and END lines that Apache, Nginx and OpenSSL expect. Drop a .der, .cer or .crt file, or paste PEM if that is what you have — the direction is detected from the input, so the same page converts both ways. A file holding several structures is converted one at a time, in order, so a certificate chain comes back as a chain rather than as its first entry alone. If the input is a certificate, its subject, issuer and validity dates are shown alongside the output, so you can confirm what you are about to paste into a server config. The conversion happens in your browser and the file is not uploaded, which is not a convenience here: these files routinely contain private key material.

Web Server DeploymentA certificate arrives from an enterprise CA as a binary .cer, and Apache or Nginx needs PEM before the virtual host will start.
OpenSSL CompatibilityConvert a binary file into the PEM that OpenSSL commands, scripts and most CI tooling accept, so it can be inspected or concatenated with the rest of a bundle.
Moving a Private KeyConvert a DER-encoded RSA or EC key to PEM locally, so the encoding change does not require handing the key to an online service.
CSR SubmissionA request generated in binary form by a device or a script needs PEM text before most public CA portals will accept it.
Reading an Opaque FileAn unlabelled .der turns up in a handover. Converting it produces readable PEM and shows the certificate's subject, issuer and dates, which is usually enough to identify it.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 Hash Generator 06 JWT Sign

Specification

Command: security.der_to_pem
Set: Security
Input: MIXED
Output: MIXED
Max file: 10MB
Batch: single file

X-X509-CA-CERT OCTET-STREAM

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

The file is opened, worked on and written back inside this tab. No upload step exists in this tool — there is nowhere for the bytes to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Drop the file or paste the input

A binary .der, .cer or .crt file, or PEM text. The direction is detected from the input, so the same page converts PEM back to DER as well.

Chains stay chains

A file holding several structures is converted block by block, in order, so a certificate chain comes back as a chain rather than as its first entry alone.

Copy or download the PEM

The output carries the BEGIN and END lines that OpenSSL, Nginx and Apache expect. If the input is a certificate, its details are shown alongside it.

Frequently asked

Why convert DER to PEM?

Because most Unix tooling wants PEM: Apache and Nginx read it, OpenSSL commands take it, and it can be concatenated, diffed and pasted into a config file as text. A binary DER can do none of those things.

How can I tell if a file is DER?

Open it in a text editor: DER is binary and shows as unreadable characters, while PEM starts with a line of dashes and the word BEGIN. Extensions are not a reliable guide — .cer and .crt are used for both. Dropping the file here is quicker: the direction is detected from the contents.

Will the conversion change the certificate?

No. PEM is DER, Base64'd and wrapped in header lines. The subject, dates, public key, extensions and signature are unchanged, so anything that verified before still verifies after.

Can I convert any type of DER file?

Certificates, private keys, public keys and certificate signing requests all convert. Each comes back with the BEGIN and END label that matches what it is, which is what a server or an OpenSSL command reads to know how to treat the file.

Is it safe to convert my certificates here?

The file is read and rewritten in your browser; nothing is uploaded and nothing is stored. That is the reason to convert a private key here rather than in a web service that receives the file.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

Related · Security Tools