DevTransformFREE
Zero-Upload • 100% Client-Side
OpenSSL • Format Conversions

How to Convert CRT, CER or DER to PEM Format

Many Java applications, Windows export wizards, and hardware firewalls export certificates in binary DER format. Converting them to ASCII PEM format (`-----BEGIN CERTIFICATE-----`) makes them compatible with modern Linux servers and cloud load balancers.

Convert DER / CRT to PEM Command
Safe • Read-Only / File Generation
openssl x509 -inform der -in certificate.cer -out certificate.pem
Customize:
Domain:
Cert File:

OpenSSL Flags & Options Explained

-inform derSpecifies input format as binary DER (Distinguished Encoding Rules)
-outform pemSpecifies output format as base64 ASCII PEM (default)

Execution Steps & Verification

1Check if certificate is binary or ASCII

Open the file in a text editor or run `head -n 1 certificate.cer`. If it begins with `-----BEGIN CERTIFICATE-----`, it is already PEM! If binary garble, it is DER.

2Convert DER to PEM

Execute the format translation:

openssl x509 -inform der -in certificate.cer -out certificate.pem
3Verify converted PEM file

Confirm the converted certificate is valid:

openssl x509 -in certificate.pem -noout -subject

Common Security Pitfalls & Solutions

  • Many files with `.crt` extension are already in PEM format. You only need this conversion if `openssl x509 -in file.crt` returns "unable to load certificate".

Prerequisites & Environment

  • Input certificate file in DER binary format.

Frequently Asked Questions About Convert DER / CRT to PEM

Frequently Asked Questions

Frequently Asked Questions

Everything you need to know regarding specifications, syntax, and security best practices.

Reverse the parameters: `openssl x509 -outform der -in cert.pem -out cert.der`.

Related OpenSSL & Security Commands

View All Recipes
Generation & Keys

How to Generate a Self-Signed SSL Certificate with OpenSSL

reqGuide →
Verification & Inspection

How to Check SSL Certificate Expiration Date from Domain or File

s_clientGuide →
Verification & Inspection

How to View and Inspect SSL Certificate Details (Subject, Issuer, SAN)

x509Guide →
Verification & Inspection

How to Verify Private Key Matches SSL Certificate (Modulus MD5 Check)

x509Guide →
Generation & Keys

How to Generate a Certificate Signing Request (CSR) with SAN

reqGuide →
Format Conversions

How to Convert PFX / PKCS#12 to PEM Certificate and Private Key

pkcs12Guide →