Converting an SSL certificate means switching between different formats. This is usually needed when a server or service supports only a specific format. Here are the most common SSL formats and how to convert them:
| Format | Description | File Extension |
|---|---|---|
| PEM | ASCII format, usually used on Apache servers | .pem, .crt, .cer, .key |
| DER | Binary format, usually used on Java platforms | .der |
| PFX/P12 | Archive containing certificate + private key + CA bundle | .pfx, .p12 |
| CRT | Certificate file, usually in PEM format | .crt |
| KEY | Private key file | .key |
🛠️ Conversion Commands with OpenSSL
PEM → DER
openssl x509 -in certificate.pem -outform der -out certificate.der
DER → PEM
openssl x509 -in certificate.der -inform der -out certificate.pem -outform pem
PEM → PFX
openssl pkcs12 -export -out certificate.pfx -inkey private.key -in certificate.crt -certfile ca_bundle.crt
PFX → PEM
openssl pkcs12 -in certificate.pfx -out certificate.pem -nodes
💡 Tips
-
If OpenSSL is not installed, you can install it on Linux with
sudo apt install openssl, and on Windows with Win32 OpenSSL. -
You may be asked for a password during conversion; this protects the private key.
-
Some panels (for example Plesk, cPanel) support automatic conversion.
