PEM to DER Converter

Overview

Turn a PEM certificate or key into binary DER, the format Java keystores, Windows certificate stores and many mobile and embedded TLS stacks expect. Drop a .pem file or paste the text, or give it DER to get PEM back. Chains are converted block by block, and for a certificate you see its subject, issuer and dates. It all runs in your browser, which matters when the file is a private key.

Java keystore importkeytool and most JVM servers expect DER, so convert the PEM you were sent before importing it.
Windows certificate storeWindows and IIS usually want a binary .cer or .crt instead of the PEM text most CAs send.
Mobile and embedded devicesiOS, Android and some embedded TLS stacks only accept DER and give no useful error with PEM.
Moving a private keyConvert an RSA or EC private key locally, so the one file that must stay private never gets uploaded.
Unpacking a bundleSee what's in a PEM file with several certificates by converting it block by block.

Guides

01 How to read what is actually in an SSL certificate

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.pem_to_der
Set: Security
Input: MIXED
Output: MIXED
Max file: 10MB
Batch: single file

X-PEM-FILE PLAIN

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

Your file is opened, worked on and saved inside this tab. This tool has no upload step, so your file has nowhere else to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Drop or paste

A .pem file, or the text with its BEGIN and END lines. DER input is converted back to PEM.

Chains stay whole

A file with several blocks, like a certificate and its intermediates, is converted block by block, in order.

Check, then download

For a certificate, you see its subject and dates next to the result, so you know it's the right one.

Frequently asked

What's the difference between PEM and DER?

DER is the binary encoding. PEM is the same bytes in Base64, wrapped in BEGIN and END lines so you can paste it as text. Converting between them changes nothing inside.

When should I use DER instead of PEM?

When the software asks for it. Java keytool, JVM servers, Windows certificate stores, IIS and many mobile and embedded TLS stacks want DER. Web servers on Unix almost always want PEM.

Will conversion affect the certificate?

No. Only the outer encoding changes. The subject, dates, public key, extensions and signature stay byte for byte the same, so the certificate verifies exactly as before.

Can I convert private keys as well?

Yes. Private keys, public keys, certificates and CSRs are all PEM blocks and all convert. Your key is read and rewritten in your browser, so it never goes to a web service.

What about a file with several blocks in it?

Each block is converted in order and comes back as its own result, so a chain stays a chain.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/