SSL Converter — PEM ⇄ DER
Convert an SSL certificate between PEM and DER formats. Runs entirely in your browser.
About this tool
The SSL Converter translates a certificate between the two encodings you meet most often: PEM, the base64 text block wrapped in BEGIN and END CERTIFICATE lines, and DER, the raw binary form of the same certificate. Paste a PEM block to get base64-encoded DER, or paste base64 DER to get a properly wrapped PEM file.
Both formats carry identical data; only the packaging differs, and platforms disagree about which they want. Apache, Nginx and most Linux tooling expect PEM, while Java keystores, Windows tooling and various appliances hand out or expect DER. Converting by hand is easy to get wrong around line wrapping and stray whitespace. This tool runs entirely in your browser, so the certificate never leaves your machine. To read what is inside a certificate rather than re-encode it, use the SSL certificate decoder.
How to use it
Paste your certificate into the input box and choose the direction you need.
- Select PEM → DER when the input starts with BEGIN CERTIFICATE and the target system wants a binary file.
- Select DER (Base64) → PEM when you have raw base64 with no header lines and need a standard text certificate.
- Copy the output exactly as produced, including the header and footer lines and the final newline.
- Convert one certificate at a time. For a chain, convert each separately and concatenate them leaf first, then the intermediates.
- If conversion fails, the input is usually not a certificate — check you have not pasted a CSR, a private key or a PKCS#12 container.
Common questions
What is the practical difference between PEM and DER?
None in terms of content. DER is the binary encoding of the certificate structure; PEM is that same binary base64-encoded and wrapped in BEGIN and END lines so it can be handled as text. Which you need is decided entirely by the software consuming the file.
Can I convert PFX, P12 or JKS files here?
No. Those are password-protected containers that can hold a private key alongside the chain, so extracting them requires the password and is best done locally with openssl or keytool. This tool handles certificate encoding only and never asks for a private key.
Does the file extension matter?
Not to the format itself. A .crt, .cer or .pem file may hold either encoding, which is a common source of confusion. Open it in a text editor: BEGIN CERTIFICATE means PEM, binary characters mean DER, whatever the extension says.