> Convert certificates, keys, CSRs, CRLs and P7B bundles between DER and PEM with OpenSSL, certutil or keytool, and prove the content stayed the same. Source: https://pkizerotohero.com/guides/convert-der-pem/ · Last reviewed: 2026-10-20 How-to guide · Convert file formats # How to convert between DER and PEM **In one sentence:** You will have identified whether a file is DER or PEM and converted certificates, keys, CSRs, CRLs and bundles between the two, with proof that nothing changed. Task [Convert file formats](https://pkizerotohero.com/guides/#task-convert) Platforms - Linux - macOS - Windows - Java Who it is for - [Developer](https://pkizerotohero.com/start/#developer) - [IT ops](https://pkizerotohero.com/start/#itops) - [Beginner](https://pkizerotohero.com/start/#beginner) Level Beginner · 8 steps ## Before you start - **OpenSSL** (Linux, macOS with Homebrew, or Git Bash on Windows). On Windows without Git Bash, `certutil` handles certificates (step 7); with a JDK, `keytool` does too (step 8). - **The file to convert.** The extension (`.cer`, `.crt`, `.der`) does not tell you the format; the content does. [DER](https://pkizerotohero.com/handbook/glossary/#der) is the binary encoding of a certificate or key. [PEM](https://pkizerotohero.com/handbook/glossary/#pem) is the same bytes in Base64, between `-----BEGIN …-----` and `-----END …-----` lines. Windows, Java and many appliances often hand you DER; Linux servers usually want PEM. ## Steps ### 1. Find out which one you have ```bash head -1 www.cer head -c 4 www.der | od -An -tx1 ``` ```text -----BEGIN CERTIFICATE----- 30 82 03 39 ``` - Text that starts with `-----BEGIN` is PEM, and the word after `BEGIN` says what it holds. - Binary that starts with the byte `30` is DER: every certificate, key, CSR and CRL is an ASN.1 `SEQUENCE`, and that byte opens it. On Linux and in Git Bash, `file -b` often names it: `Certificate, Version=3` for a DER certificate, `PEM certificate` for PEM. Do not rely on `file` for keys; it can mislabel them. ### 2. Convert a certificate ```bash # DER to PEM openssl x509 -inform DER -in www.der -out www.pem # PEM to DER openssl x509 -in www.pem -outform DER -out www.der ``` OpenSSL 3 detects DER input on its own for `openssl x509`, but `-inform DER` is harmless and needed on OpenSSL 1.1.1. A DER file holds exactly one object; if your PEM file contains several certificates, `openssl x509` converts only the first. ### 3. Convert keys, CSRs and CRLs Each object type has its own OpenSSL command, and the options are the same: | Object | DER to PEM | PEM to DER | | --- | --- | --- | | Private or public key | `openssl pkey -inform DER -in key.der -out key.pem` | `openssl pkey -in key.pem -outform DER -out key.der` | | CSR | `openssl req -inform DER -in req.der -out req.pem` | `openssl req -in req.pem -outform DER -out req.der` | | CRL | `openssl crl -inform DER -in ca.crl -out ca-crl.pem` | `openssl crl -in ca-crl.pem -outform DER -out ca.crl` | For a public key, add `-pubin` to the `pkey` commands. A DER private key is still a secret: converting it changes nothing about how carefully you must store it. CRLs downloaded from a CA are usually DER; after conversion the PEM file starts with `-----BEGIN X509 CRL-----`. ### 4. Convert a PKCS #7 bundle (.p7b) A `.p7b` file carries several certificates, often as DER. Unpack it into one PEM file: ```bash openssl pkcs7 -inform DER -in chain.p7b -print_certs -out chain.pem ``` Our test bundle held two certificates, and `chain.pem` then had two `BEGIN CERTIFICATE` blocks. To go the other way, `openssl crl2pkcs7 -nocrl -certfile chain.pem -outform DER -out chain.p7b`. ### 5. Convert an issuer certificate you downloaded The “CA Issuers” address in a certificate’s [Authority Information Access](https://pkizerotohero.com/handbook/glossary/#authority-information-access) extension usually serves DER. For example, letsencrypt.org’s certificate points to its issuer: ```bash openssl s_client -connect letsencrypt.org:443 -servername letsencrypt.org /dev/null \ | openssl x509 -noout -ext authorityInfoAccess curl -sS -o ye2.der http://ye2.i.lencr.org/ openssl x509 -inform DER -in ye2.der -out ye2.pem openssl x509 -in ye2.pem -noout -subject -issuer ``` ```text Authority Information Access: CA Issuers - URI:http://ye2.i.lencr.org/ subject=C=US, O=Let's Encrypt, CN=YE2 issuer=C=US, O=ISRG, CN=Root YE ``` The server sent the file as `application/pkix-cert`, which is DER. Plain HTTP is fine here: the certificate is verified by its signature, not by how it travelled. [How to build the full chain file](https://pkizerotohero.com/guides/build-fullchain/) shows where such a file goes next. ### 6. Decode a Base64 block without BEGIN and END lines Portals and APIs sometimes show a certificate as bare Base64. Decode it straight to DER: ```bash openssl base64 -d -A -in body.txt -out cert.der # Base64 on one long line openssl base64 -d -in body.txt -out cert.der # Base64 wrapped in lines of 64 characters ``` Choose the right one: on a single long line without `-A`, OpenSSL can write an empty or cut-off file without printing any error (in our tests, a 1,060-character line gave 0 or 25 bytes). Then convert `cert.der` as in step 2. ### 7. On Windows, with certutil ```powershell certutil -encode www.der www.pem certutil -decode www.pem www.der ``` ```text Input Length = 829 Output Length = 1200 CertUtil: -encode command completed successfully. Input Length = 1200 Output Length = 829 CertUtil: -decode command completed successfully. ``` `-encode` writes a file with `-----BEGIN CERTIFICATE-----` lines, so OpenSSL and Linux servers read it as PEM. `-decode` reverses it. Both refuse to overwrite an existing output file; add `-f` to force it. In the Windows certificate export wizard, “DER encoded binary X.509 (.CER)” gives DER and “Base-64 encoded X.509 (.CER)” gives PEM, with the same extension. ### 8. In Java, with keytool ```bash keytool -exportcert -alias shop -keystore shop.p12 -file shop.cer # DER keytool -exportcert -rfc -alias shop -keystore shop.p12 -file shop.pem # PEM ``` `keytool -importcert` and `keytool -printcert` accept both formats. ## Check it worked A conversion must not change the certificate. Its SHA-256 [fingerprint](https://pkizerotohero.com/handbook/glossary/#fingerprint) is computed over the DER bytes, so it is the same for both files, and equal to a plain SHA-256 of the DER file: ```bash openssl x509 -in www.pem -noout -fingerprint -sha256 openssl x509 -inform DER -in www.der -noout -fingerprint -sha256 sha256sum www.der ``` ```text sha256 Fingerprint=67:E1:E5:8B:37:05:E5:60:D5:61:B0:68:B2:A9:29:BF:87:15:FB:B1:22:F6:C8:01:8E:3A:22:2E:59:34:0C:7D sha256 Fingerprint=67:E1:E5:8B:37:05:E5:60:D5:61:B0:68:B2:A9:29:BF:87:15:FB:B1:22:F6:C8:01:8E:3A:22:2E:59:34:0C:7D 67e1e58b3705e560d561b068b2a929bf8715fbb122f6c8018e3a222e59340c7d *www.der ``` You can also paste the PEM certificate into the decoder: *Interactive tool: Certificate decoder (runs in the browser at [/tools/decoder/](https://pkizerotohero.com/tools/decoder/))* ## If something goes wrong - **`Could not read certificate from …`** (OpenSSL 3.0), **`Could not find certificate from …`** (3.2) or **`unable to load certificate`** (1.1.1): the file is not a certificate in the format you named. Check step 1: it may be a key, a CSR, a `.p7b` (step 4) or a PFX ([How to convert PFX to PEM](https://pkizerotohero.com/guides/convert-pfx-pem/)). - **Only one certificate came out:** `openssl x509` reads one object. Use a `.p7b` (step 4) or keep the bundle in PEM. - **An empty or truncated file after `openssl base64 -d`:** the input is on one line; add `-A` (step 6). - **`CertUtil: -encode command FAILED: 0x80070050 (WIN32: 80 ERROR_FILE_EXISTS)`:** the output file already exists. Add `-f`, or choose a new name. - **A server still rejects the PEM file:** check that it starts with the right `BEGIN` line and contains what the server expects, such as the full chain: [How to build the full chain file](https://pkizerotohero.com/guides/build-fullchain/). ## Why this works Certificates, keys, CSRs and CRLs are ASN.1 structures, and DER is their one canonical binary encoding. PEM, defined in [RFC 7468](https://www.rfc-editor.org/rfc/rfc7468), is those exact DER bytes in Base64 with a label. Converting therefore changes only the wrapping. A signature covers the DER bytes of the signed data, so it stays valid in either form, and the fingerprint stays the same. The [file formats appendix](https://pkizerotohero.com/handbook/file-formats/) compares DER, PEM, PKCS #7, PKCS #12 and the Java keystores, and [Anatomy of an X.509 certificate](https://pkizerotohero.com/handbook/x509-certificates/) shows the ASN.1 structure inside. ## Go deeper - [RFC 7468](https://www.rfc-editor.org/rfc/rfc7468): PEM encodings and the labels after `BEGIN`. - [OpenSSL format options](https://docs.openssl.org/master/man1/openssl-format-options/): `-inform`, `-outform` and how input formats are detected. - [OpenSSL `x509`](https://docs.openssl.org/master/man1/openssl-x509/), [`pkcs7`](https://docs.openssl.org/master/man1/openssl-pkcs7/) and [`crl2pkcs7`](https://docs.openssl.org/master/man1/openssl-crl2pkcs7/) manuals. - [RFC 5280, section 4.2.2.1](https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1): the Authority Information Access extension and its “CA Issuers” method. - [Microsoft Learn: certutil](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil): `-encode` and `-decode`. - [Oracle: keytool](https://docs.oracle.com/en/java/javase/21/docs/specs/man/keytool.html): `-exportcert` and `-rfc`. **Early edition.** Checked against the standards; an independent expert review is in progress. Found a mistake? [Tell us](https://pkizerotohero.com/contact/?topic=content-error&page=/guides/convert-der-pem/). Last reviewed 20 October 2026Edition 0.9 ## Keep going ### Learn why it works - [File formats: PEM, DER, PKCS #12 and friends](https://pkizerotohero.com/handbook/file-formats/) - [Chapter 8: Anatomy of an X.509 certificate](https://pkizerotohero.com/handbook/x509-certificates/) ### Tools - [Certificate decoder](https://pkizerotohero.com/tools/decoder/): Paste a PEM certificate and read every field in plain words. ### Topics - [Certificates](https://pkizerotohero.com/topics/certificates/) ## More guides: Convert file formats - [How to convert PFX (PKCS #12) to PEM and back](https://pkizerotohero.com/guides/convert-pfx-pem/) - [How to convert a Java keystore (JKS) to PKCS #12](https://pkizerotohero.com/guides/convert-jks-pkcs12/)