SSL Certificate Converter

Switch a certificate between PEM, DER, P7B and PFX (PKCS#12) without installing OpenSSL. The conversion runs in your browser, so your private key and passwords never leave your device.

Short answer

The SSL Converter converts certificates between PEM, DER, P7B and PFX/PKCS#12 formats entirely in your browser. You can bundle a certificate, its intermediates and its private key into a password-protected PFX, or open a PFX back into PEM. Private keys and passwords are never uploaded or stored.

Last updated: 2026-10-18

What are PEM, DER, P7B and PFX files?

They are different containers for the same certificate data: PEM and DER hold a single item, P7B holds certificates only, and PFX holds certificates plus the private key.

Format	Typical extensions	Contains	Commonly used by
PEM	.pem .crt .cer .key	Base64 text with BEGIN and END lines	Apache, Nginx, most control panels
DER	.der .cer	The same data in binary form	Some Java and Windows tools
P7B / PKCS#7	.p7b .p7c	Certificates and chain only, no private key	Windows, Tomcat, some CAs
PFX / PKCS#12	.pfx .p12	Certificate, chain and private key, password protected	IIS and Windows, Java, backups

How do I convert a certificate between formats?

Pick the conversion, supply the input and press Convert; the result appears below with download buttons.

PEM to DER: paste the PEM text and download the binary file.
DER to PEM: open the DER file (or paste base64); the type is detected automatically.
PEM to P7B: paste your certificate and the intermediates; you get a P7B with no private key.
P7B to PEM: open the P7B and copy every certificate as PEM.
PEM to PFX: paste the certificate and intermediates, the matching private key, and choose a password for the new file.
PFX to PEM: open the PFX and enter its password to get certificates and the key as PEM.

When building a PFX the tool first checks that the key matches one of your certificates and puts that certificate first, which is the order Windows expects.

Which format does my server or panel need?

Match the format to the software that will import it.

Apache and Nginx: PEM files: the certificate, the intermediate chain and the private key.
IIS and Windows Server: a PFX that contains the certificate, chain and key.
Java and Tomcat: PKCS#12 (PFX), or a P7B for the certificate chain.
Control panels such as cPanel: usually ask you to paste PEM text for the certificate, key and chain.

If your host created the CSR for you, you may not hold the private key at all, and a PFX cannot be built without it; ask the host to install the certificate. For a UAE business site on a typical shared host, pasting PEM text into the panel is usually all you need.

What can go wrong during conversion?

Most failures come from a missing password, a mismatched key or an unsupported key type.

Wrong PFX password: the file cannot be decrypted. There is no recovery, so keep the password with the file in a password manager.
Key does not match the certificate: a PFX built from them would not work; check with the Certificate-Key Matcher.
ECDSA keys: this tool builds PFX files from RSA keys only. For ECDSA use OpenSSL, as shown on the page.
Old systems: choose 3DES for the PFX encryption if an older Windows or Java rejects the AES option.
Safe handling: a PFX or a PEM key is as sensitive as a password. Delete spare copies and never email them.

To check the result, decode the certificate with the Certificate Decoder.

Frequently asked questions

What is the difference between PEM and PFX?

PEM is a text format that usually holds one item, such as a certificate or a key, and is what Apache and Nginx use. PFX (PKCS#12) is a single password-protected file containing the certificate, intermediate chain and private key, and is what IIS and Windows import. You can convert in both directions with this tool.

Is my private key uploaded when I convert?

No. The conversion runs in JavaScript inside your browser tab. Your private key, certificates and passwords are not sent to any server, saved in cookies or browser storage, or placed in the address bar. Clear the page when you finish and delete any downloaded files you no longer need.

Why can't I open my PFX file?

Usually the password is wrong, or the file uses an encryption this tool cannot read, which can happen with files created by newer OpenSSL options. The PFX password cannot be recovered. If you know the password and the file still fails, convert it with OpenSSL, using the commands shown below the converter.

Should I choose 3DES or AES-256 for a PFX?

Choose 3DES if you are unsure: it is understood by older Windows versions, IIS and Java. AES-256 is stronger and fine for current Windows 10 and later systems and recent Java versions. If the target system rejects the file or asks for a different password, rebuild it with 3DES.

Can I convert an ECDSA certificate to PFX?

Not with this tool: the PFX builder supports RSA keys only. PEM, DER and P7B conversions work with any key type, and the converter can also open a PFX that contains an ECDSA key. To build a PFX from an ECDSA key, use the OpenSSL command shown on the page.