Browser 106

max 10MB

Inspector security/pem-to-der

PEM to DER Converter

Overview

PEM to DER strips the Base64 armour and the BEGIN and END lines from a PEM block and gives you the binary DER underneath — the form Java keystores, Windows certificate stores and several mobile and embedded TLS stacks require. Drop a .pem file or paste the text; the direction is worked out from what you supply, so the same page converts DER back to PEM when that is what you have. A file holding several blocks, such as a certificate with its intermediates, is converted block by block in order rather than stopping at the first, so a chain survives the trip. If the input is a certificate, its subject, issuer and validity dates are shown next to the result, which is how you confirm you converted the file you meant to before saving the binary. Nothing is uploaded, which matters when the block is a private key.

Java Keystore Importkeytool and most JVM-based servers expect DER-encoded certificates; convert the PEM you were sent before importing it into a keystore.
Windows Certificate StoreWindows certificate management and IIS import dialogs generally want a binary .cer or .crt rather than the text PEM a Unix-oriented CA hands out.
Mobile and Embedded TargetsiOS, Android and several embedded TLS stacks accept only DER, and produce no useful error when given PEM. Convert here rather than shipping a file that fails at runtime.
Moving a Private KeyConvert an RSA or EC private key between encodings locally, so the one file that must never be uploaded is not uploaded.
Splitting a BundleA concatenated PEM file arrives with no explanation of what is in it. Converting it block by block, with each certificate's details shown, is a quick way to see what you were actually given.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.pem_to_der
Set: Security
Input: MIXED
Output: MIXED
Max file: 10MB
Batch: single file

X-PEM-FILE PLAIN

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

The file is opened, worked on and written back inside this tab. No upload step exists in this tool — there is nowhere for the bytes to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Drop the file or paste the text

A .pem file, or the block with its BEGIN and END lines. The direction is worked out from what you give it, so the same page converts DER back to PEM as well.

Chains stay chains

A file holding several blocks — a certificate and its intermediates, say — is converted block by block, in order, rather than stopping at the first one.

Confirm what you converted, then download

If the input is a certificate, its details are shown next to the result, so you can check the subject and the validity dates are the ones you expected before you save the binary.

Frequently asked

What's the difference between PEM and DER?

DER is the actual binary encoding of the structure. PEM is that same binary, Base64'd and wrapped in BEGIN and END lines so it can be pasted into a text file. Converting between them changes nothing inside: the same bytes come out the other side.

When should I use DER instead of PEM?

When the consumer asks for it: Java keytool and JVM-based servers, Windows certificate stores and IIS import dialogs, and a number of mobile and embedded TLS stacks all want the binary form. Web servers on Unix almost always want PEM.

Will conversion affect the certificate?

No. Only the outer encoding changes. The subject, the validity dates, the public key, the extensions and the signature are byte-for-byte identical, so a certificate converted here still verifies exactly as it did before.

Can I convert private keys as well?

Yes — private keys, public keys, certificates and CSRs are all PEM blocks and all convert. A private key is exactly the kind of file that should not be handed to a web service, which is the point of doing it here: it is read and rewritten in your browser.

What about a file with several blocks in it?

A bundle holding a certificate and its intermediates is converted block by block, in order, rather than stopping at the first. Each block comes back as its own result, so a chain arrives as a chain.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

Related · Security Tools