Certificate converter (PEM, DER, PKCS#7, PKCS#12)

One certificate, several containers

An X.509 certificate is an ASN.1 structure. DER is that structure serialized to raw bytes — compact, binary, not human-readable. PEM takes those exact bytes, Base64-encodes them, and wraps them in -----BEGIN CERTIFICATE----- / -----END CERTIFICATE----- lines so the result is plain text you can paste anywhere. On top of those two encodings sit two common containers: PKCS#7 bundles a certificate chain, and PKCS#12 bundles a certificate together with its private key behind a password.

Which format does your software expect?

• PEM (.pem, .crt, .cer) — Apache, Nginx, HAProxy and most Linux/OpenSSL tooling.
• DER (.der, .cer) — Java keystores and various Windows and appliance tools.
• PKCS#7 (.p7b, .p7c) — a certificate chain (leaf + intermediates), no private key. Common with Windows/IIS and Java.
• PKCS#12 (.pfx, .p12) — a certificate and its private key, password-protected. Used to import/export identities in Windows/IIS, macOS Keychain and many appliances.
• The .cer extension is ambiguous — it is used for both PEM and DER, so check the actual encoding when a tool rejects a file.

How to use it

1. Pick a format (or leave it on Auto-detect, which uses the file extension and content).
2. Provide the input. Upload a file, or paste PEM. For a PKCS#12 (.pfx) enter its password.
3. Get the result. Binary outputs (DER, .p7b, .pfx) download as a file; PEM outputs are shown as copyable text with a download button. Extracting a .p7b yields the whole certificate chain; extracting a .pfx yields the certificate(s) plus the private key.

Is this safe? Where does conversion happen?

Everything runs in your browser via the Web Crypto API. Certificates, private keys, and the PKCS#12 password are all processed locally — no file you upload and no text you paste is ever transmitted to nslookup.io. You can verify this in your browser's developer tools: no network request is made when you convert. This is what makes it safe to open and build .pfx files (which contain a private key) here.

Frequently asked questions

What is the difference between PEM and DER?

They are two encodings of the same certificate. DER is the raw binary ASN.1 structure. PEM is that same binary Base64-encoded and wrapped between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines, so it can be pasted as text. Converting between them never changes the certificate itself.

Which format does my software need?

Apache, Nginx and most Linux tooling expect PEM (.pem, .crt, .cer). Java keystores and many Windows tools expect DER (.der, .cer) or a bundle such as PKCS#7 (.p7b) or PKCS#12 (.pfx). If a tool rejects your file, converting to the format it expects is often all that is needed. Note that the .cer extension is used for both PEM and DER.

What is a .p7b (PKCS#7) file?

A PKCS#7 file (.p7b / .p7c) is a bundle of one or more certificates — typically a certificate plus its intermediate/root chain. It contains no private key. This tool extracts every certificate from a .p7b as PEM, and can package pasted PEM certificates back into a .p7b.

What is a .pfx / .p12 (PKCS#12) file?

A PKCS#12 file (.pfx / .p12) bundles a certificate together with its matching private key, protected by a password. It is what Windows/IIS and many appliances import and export. This tool can open a .pfx (with the password) and split it into PEM certificate + private key, or build a new .pfx from a pasted certificate and private key. Because it carries a private key, everything happens in your browser — the file is never uploaded.

Is it safe to convert my certificate — and my private key — here?

Yes — every conversion happens entirely in your browser using the Web Crypto API. Nothing you upload, paste, or the password you type is ever sent to our servers, which you can confirm in your browser network tab. This is why PKCS#12 (which contains a private key) is safe to handle here; the bytes never leave your machine.

Can I convert a CSR too?

Yes. This tool detects a certificate signing request and converts it between PEM and DER the same way, keeping the correct CERTIFICATE REQUEST header when producing PEM.

Related tools

• CSR & certificate decoder — see exactly what a certificate or CSR contains
• CSR generator — create a new CSR and private key in your browser
• SSL checker — inspect the certificate a live site is serving
• DNS lookup — see all records for any domain