(DC) Certificate Format Conversion
Description
This document discusses the use of many different tools to get a certificate into a specific format that is required for a service to import it. There are request, import, and archival formats that can be used.
- 1 Description
- 2 Certificate Format Reference
- 3 Certificate Conversion Tools
- 4 Local conversion with OpenSSL
- 4.1 Convert PEM to DER, P7B or PFX
- 4.1.1 Convert PEM to DER
- 4.1.2 Convert PEM to P7B
- 4.1.3 Convert PEM to PFX
- 4.2 Convert DER to PEM
- 4.2.1 Convert DER to PEM
- 4.3 Convert P7B to PEM or PFX
- 4.3.1 Convert P7B to PEM
- 4.3.2 Convert P7B to PFX
- 4.4 Convert PFX to PEM
- 4.4.1 Convert PFX to PEM
- 4.1 Convert PEM to DER, P7B or PFX
Certificate Format Reference
Format | File Extension | Notes |
|---|---|---|
PEM |
| The PEM format is the most common format that Certificate Authorities utilize to issue certificates. They are Base64 encoded ASCII files and contain "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" statements. Server certificates, intermediate certificates, and private keys can all be put into the PEM format. Several PEM certificates, and even the private key, can be included in one file, one below the other, but most platforms, such as Apache, expect the certificates and private key to be in separate files. Used by: Apache and similar Unix based systems/applications. |
DER |
| The DER format is simply a binary form of a certificate instead of the ASCII PEM format. All types of certificates and private keys can be encoded in DER format. Used by: Java platforms |
PKCS#7 |
| This is usally a Base64 based ASCII format, that like PEM, contain "-----BEGIN PKCS7-----" and "-----END PKCS7-----" statements. Can contain certificates and chain certificates but not private keys. Used by: Microsoft Windows and Java Tomcat. |
PKCS#12 |
| This, like DER, is a binary format for storing the server and any intermediate certificates, and the private key in one encrypted file. The format is typically used on Windows machines to import and export certificates and private keys. Used by: Windows OS workstations and servers. |
Certificate Conversion Tools
|
|
|---|---|
 | ONLINE: SSL Shopper SSL Certificate Converter |
| ONLINE: LeaderSSL Certificate Converter |
Local conversion with OpenSSL
Convert PEM to DER, P7B or PFX
Convert PEM to DER
openssl x509 -outform der -in certificate.pem -out certificate.der
Convert PEM to P7B
openssl crl2pkcs7 -nocrl -certfile certificate.cer -out certificate.p7b -certfile CACert.ce
Convert PEM to PFX
openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crConvert DER to PEM
Convert DER to PEM
openssl x509 -inform der -in certificate.cer -out certificate.pemConvert P7B to PEM or PFX
Convert P7B to PEM
openssl pkcs7 -print_certs -in certificate.p7b -out certificate.ce
Convert P7B to PFX
openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer
openssl pkcs12 -export -in certificate.cer -inkey privateKey.key -out certificate.pfx -certfile CACert.ceConvert PFX to PEM
Convert PFX to PEM
openssl pkcs12 -in certificate.pfx -out certificate.cer -nodes