ES
Home › Developer Tools › SSL Certificate Converter

SSL Certificate Converter

Convert certificates and private keys between PEM (.pem, .crt, .key), DER (.cer, .der), PFX/P12 and P7B. Drop your files, see what is inside, confirm the key matches the certificate, and download the format your server needs. Everything runs in your browser, so keys never leave your device.

Last updated:

Drop certificate and key files or choose files.pem .crt .cer .der .key .pfx .p12 .p7b .p7c, several at once. Nothing is uploaded.

Contents

Convert to

Advertisement
Advertisement

How to use the SSL Certificate Converter

  1. Drop your files: a PFX, or a certificate plus its private key and chain (.crt, .pem, .key, .cer, .p7b). You can also paste PEM text.
  2. Enter the password and click Unlock if the PFX or key is protected.
  3. Check the contents: the certificate should show matches key and the chain should run leaf, intermediate, root.
  4. Pick the output format: PEM for nginx and Apache, PFX/P12 for IIS, Windows and Azure, P7B for Windows or Java chain import, DER for Java and some appliances.
  5. Download the converted file. For a PFX, set an export password first.

Certificate formats at a glance

FormatExtensionsEncodingContainsTypical use
PEM.pem .crt .cer .key .ca-bundleBase64 textCertificates, chain and/or keynginx, Apache, HAProxy, Node.js, Linux tools
DER.der .cerBinaryOne certificate or one keyJava, Windows certificate import, embedded devices
PFX / P12.pfx .p12Binary, password protectedCertificate, chain and private keyIIS, Windows, Azure, Exchange, Java keystores
P7B / PKCS#7.p7b .p7cBase64 or binaryCertificates and chain onlyWindows and Tomcat chain import, CA downloads

Which file does my server need?

  • nginx: ssl_certificate points to the full chain (leaf first, then intermediates) and ssl_certificate_key to the PEM key.
  • Apache 2.4.8+: SSLCertificateFile can hold the leaf plus intermediates; SSLCertificateKeyFile holds the key.
  • IIS, Windows Server and Azure App Service: import a PFX with the private key and chain.
  • Tomcat and Java: recent versions use a PKCS#12 keystore directly (a .p12 file with keystoreType="PKCS12").
  • Cloud load balancers: usually ask for the certificate body, private key and chain as separate PEM fields.

Private key formats

BEGIN PRIVATE KEY is PKCS#8, the modern format for RSA, EC and Ed25519 keys, and the default here. BEGIN RSA PRIVATE KEY (PKCS#1) and BEGIN EC PRIVATE KEY (SEC1) are the older OpenSSL formats still required by some software. BEGIN ENCRYPTED PRIVATE KEY is PKCS#8 protected with a password; this tool encrypts it with PBKDF2-SHA256 (100,000 iterations) and AES-256-CBC. To inspect a certificate's extensions and SANs in detail, use the SSL Certificate Decoder.

Frequently asked questions

What is the difference between PEM, DER, PFX and P7B?

PEM is Base64 text between -----BEGIN----- and -----END----- lines and can hold certificates and keys; .crt, .pem and .key files are usually PEM. DER is the same data in binary, one object per file, often named .cer or .der. PFX (also called P12 or PKCS#12) is a password-protected binary bundle with the certificate, chain and private key. P7B (PKCS#7) holds certificates and the chain but never a private key.

How do I convert a PFX to a CRT and KEY file for nginx or Apache?

Drop the .pfx file, enter its password and click Unlock. In the PEM tab, click Download separate files to get the certificate (.crt), the chain, a full chain and the private key (.key). nginx uses the full chain file for ssl_certificate and the .key for ssl_certificate_key.

How do I create a PFX from a certificate and private key?

Drop the certificate (.crt or .pem), the private key (.key) and optionally the intermediate certificates. Check that the certificate shows matches key, open the PFX / P12 tab, enter an export password and click Create PFX. Choose the 3DES option only if the PFX must import on Windows Server 2016 or older Java versions.

Why does Windows say the PFX password is wrong when it is correct?

Older Windows versions (Windows Server 2016 and earlier, Windows 10 before 1709) cannot read PFX files encrypted with AES, which OpenSSL 3 and this tool use by default. Create the PFX again with the legacy 3DES + SHA-1 option, which those systems support.

Is it safe to convert a private key online?

This converter does all parsing, decryption and encryption in your browser with the Web Crypto API; nothing is sent to a server. The forge library is only downloaded when a file uses legacy 3DES or RC2 encryption. Still, treat private keys carefully and do not leave converted copies on shared computers.

What does 'does not match any certificate' mean?

The public key inside the private key is different from the public key in the certificate, so they do not belong together and a server will refuse to start. Find the key that was generated with the certificate's CSR, or reissue the certificate with a new CSR.

Why is there no private key in my P7B file?

The PKCS#7 format used for .p7b files only carries certificates and CRLs. If your certificate authority sent a P7B, the private key is the one you created with the CSR on your server. Combine the P7B with that key to create a PFX.

Are all the tools on FreeToolCabin tested for quality and accuracy?

Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.

Related tools

SSL Certificate DecoderDecode PEM SSL/X.509 certificates: subject, issuer, expiry, SANs, key and fingerprints.Self-Signed Certificate GeneratorCreate a self-signed SSL certificate and key for localhost or dev servers, as PEM or PFX.CSR GeneratorCreate a certificate signing request (CSR) and private key with SANs, RSA or ECDSA, in your browser.Base64 Encoder DecoderEncode or decode Base64 text and files, and make data URIs.Password GeneratorCreate strong passwords and passphrases.Hash GeneratorGenerate MD5, SHA-1, SHA-256 and SHA-512 hashes of text or files.MD5 Hash GeneratorGenerate MD5 hashes of text, lines or files and verify checksums.SHA-256 Hash GeneratorSHA-256 and HMAC-SHA256 hashes of text, lines or files, in hex or Base64.URL Encoder DecoderPercent-encode or decode URLs, query strings and form data.HTML Entity Encoder / DecoderEscape and unescape HTML entities, named or numeric.Bcrypt Hash Generator & CheckerCreate bcrypt password hashes and check a password against a hash.Binary TranslatorConvert text to binary, hex, octal and back.HMAC GeneratorGenerate and verify HMAC signatures with SHA-256, SHA-512, SHA-1 or MD5.CRC32 Checksum CalculatorCalculate CRC-32, CRC-32C, CRC-16 and Adler-32 checksums of text or large files.JWT DecoderDecode JSON Web Tokens, read the claims and expiry, and verify HS256 signatures.JWT GeneratorCreate and sign HS256, HS384 or HS512 JSON Web Tokens in your browser and verify them.Password Strength CheckerSee how strong a password really is, how long it takes to crack and how to improve it.Caesar CipherEncode and decode Caesar shift ciphers and crack unknown shifts with a ranked brute force.Vigenère CipherEncrypt and decrypt Vigenère and Autokey ciphers, and crack unknown keys with frequency analysis.Atbash CipherEncode and decode Atbash ciphers (A↔Z, B↔Y) in Latin or Hebrew, with a live letter mapping table.ASCII TableFull ASCII code chart 0–255 in decimal, hex, octal, binary and HTML, with search and copy.Unicode Character LookupFind Unicode characters by name or code point and copy them with UTF-8, HTML and code escapes.Punycode ConverterConvert international domain names, emails and URLs between Unicode and xn-- Punycode, in bulk.JSON Escape / UnescapeEscape text for a JSON string, unescape \n and \" back to text, or stringify a whole object.Binary to HexConvert binary to hex instantly with steps and signed mode.Hex to BinaryConvert hex to binary instantly with steps and signed mode.Binary CalculatorAdd, subtract, multiply, divide, AND, OR, XOR and shift binary numbers with decimal values.Hex CalculatorHexadecimal + − × ÷ and AND, OR, XOR, NOT, shifts with decimal and binary equivalents.Base32 Encoder / DecoderEncode and decode Base32 (RFC 4648), Base32hex, Crockford and z-base-32 from text, hex or files.Base58 Encoder / DecoderEncode and decode Base58 and Base58Check (Bitcoin alphabet) from text or hex, with checksum verification.Unicode Escape / UnescapeConvert text to \uXXXX, \u{...}, \x, &#...; or CSS escapes and decode them back.File Hash CheckerGet MD5, SHA-1, SHA-256 and SHA-512 checksums of files and verify them against a hash.TOTP GeneratorGenerate 2FA one-time codes from a secret key, create otpauth QR codes and verify codes.RSA Key GeneratorGenerate 2048, 3072 or 4096-bit RSA key pairs as PEM, PKCS#1, JWK or OpenSSH, locally.Text Encryption ToolEncrypt and decrypt text with a password using AES-256-GCM, entirely in your browser.Argon2 Hash GeneratorHash passwords with Argon2id, Argon2i or Argon2d and verify them against an encoded hash.Base64 to PDFDecode a Base64 string to a PDF with preview and download, or encode a PDF to Base64.Bitwise CalculatorCalculate AND, OR, XOR, NOT and bit shifts at 8–64 bits with a bit grid and all bases.Pwned Password CheckerCheck if a password appeared in data breaches; only 5 characters of its SHA-1 hash are sent.RSA Encryption ToolEncrypt text with an RSA public key and decrypt it with the private key using RSA-OAEP in your browser.SAML DecoderDecode SAMLRequest and SAMLResponse messages to readable XML, attributes and validity times.Checksum CalculatorCompute 8-bit sum, two's complement LRC, XOR/BCC, NMEA, Fletcher and Internet checksums of bytes.PBKDF2 Hash GeneratorDerive PBKDF2 keys from a password, salt and iteration count with SHA-1, SHA-256 or SHA-512.Protobuf DecoderDecode raw Protocol Buffers hex or Base64 without a schema, or add a .proto for field names.XML Escape / UnescapeEscape & < > " ' for XML text and attributes, unescape entities back, or wrap text in CDATA.Binary Search Tree VisualizerInsert, delete and find in BST, AVL and red-black trees with animated rotations and traversals.MongoDB ObjectId to TimestampDecode a MongoDB ObjectId to its creation date, or build ObjectIds from dates for range queries.PGP Encrypt / DecryptEncrypt, decrypt, sign and verify PGP messages with your armored keys, entirely offline.PGP Key GeneratorGenerate an OpenPGP key pair (Curve25519, NIST ECC or RSA) with passphrase and expiry, offline.Quoted-Printable Encoder / DecoderEncode or decode quoted-printable email text (MIME) with UTF-8 and 76-character soft line breaks.SHA-1 Hash GeneratorSHA-1 and HMAC-SHA1 of text or files in hex or Base64, plus Git blob hashes and verify.SHA-512 Hash GeneratorSHA-512 and SHA-384 hashes of text or files in hex or Base64, HMAC and hash verification.SRI Hash GeneratorCreate Subresource Integrity hashes (sha256/384/512) and ready <script> or <link> tags.SSH Key GeneratorGenerate Ed25519 or RSA SSH key pairs in your browser: OpenSSH public key plus private key.String Escape / UnescapeEscape or unescape strings for JavaScript, Java, C#, Python, C, SQL, regex, CSV and shell.UTF-8 Encoder / DecoderConvert text to UTF-8 bytes in hex, decimal, binary, \x or % and decode bytes back to text.UUID Decoder & ValidatorDecode any UUID: version, variant, v1/v6/v7 timestamp and MAC node, plus bulk validation.Base64 to FileDecode Base64 or a data URI to a downloadable file; detects the real file type and previews it.File Encryption ToolEncrypt and decrypt any file with a password using AES-256-GCM, entirely in your browser.Passphrase GeneratorMake strong, memorable diceware passphrases from a 7,776-word list, with entropy in bits.CSR DecoderDecode a PEM certificate signing request: subject, SANs, key size, signature and CA readiness checks.Enigma Machine SimulatorEncrypt and decrypt with a virtual Enigma I, M3 or M4: rotors, rings, plugboard and lampboard.Hex Opacity CalculatorConvert opacity percent to a 2-digit HEX alpha code and full #RRGGBBAA color, with a 0-100% table.Playfair CipherEncrypt and decrypt Playfair ciphers from a keyword, with the 5x5 key square and every digraph step.
See all 65 Encoders, Hashes & Crypto →