Convert certificates and keys between formats
Turn PEM into DER or PFX, extract certificates and keys from a PFX, convert private keys between PKCS#1 and PKCS#8, split or join certificate chains, and add or remove a key's password. Conversions run locally; files and passwords never leave your browser.
What you can do
- PEM ↔ DER for certificates, keys, CSRs and CRLs
- Certificate + key + chain → password-protected PFX/P12
- PFX/P12 → PEM certificate, key and chain
- Split a bundle into separate certificates, or join certificates into one chain in the right order
- Private keys: PKCS#1 ↔ PKCS#8, add or remove encryption
Frequently asked questions
What is the difference between PEM and DER?
They hold the same ASN.1 data. DER is binary; PEM is the same bytes in Base64 between -----BEGIN and -----END lines. A .crt or .cer file can be either, which is why PKIScope detects the format instead of trusting the extension.
What is the difference between PKCS#1 and PKCS#8 private keys?
PKCS#1 (BEGIN RSA PRIVATE KEY) only holds RSA keys. PKCS#8 (BEGIN PRIVATE KEY) wraps any key type with an algorithm identifier and can be password-protected (BEGIN ENCRYPTED PRIVATE KEY). Most modern software expects PKCS#8.
In what order should certificates be in a chain file?
Server certificate first, then each intermediate in turn, each one signed by the next. The root is normally left out because clients already trust it. Joining certificates here puts them in that order for you.
Related tools
- PEM to PFX — Combine certificate, key and chain into a PFX/P12
- PFX to PEM — Extract certificate, key and chain from a PFX/P12
- DER to PEM — Convert binary DER/CER/CRT files to PEM text and back
- JWK converter — PEM ↔ JSON Web Key, JWKS viewer and key thumbprints