Convert DER ↔ PEM

The DER/PEM Converter transforms certificates, keys, and CSRs between DER (binary) and PEM (base64 ASCII) encoding formats -- eliminating the need to remember openssl x509 -inform/-outform command syntax when switching between Windows, Linux, and Java environments. Upload a DER file or paste PEM text and get the converted output instantly.

Understanding DER and PEM Formats

If you have worked with certificates across different platforms, you have inevitably hit the format problem. Windows exports certificates in DER binary format. Apache and nginx expect PEM text files. Java's keytool speaks DER but most configuration guides show PEM. Your colleague sent you a .cer file and you have no idea whether it is DER or PEM because the extension is ambiguous. These are all variations of the same underlying certificate data, just encoded differently.

DER (Distinguished Encoding Rules) is the raw binary representation of the certificate's ASN.1 data structure. It is compact, unambiguous, and the canonical encoding -- but it is completely unreadable in a text editor and cannot be safely copied into emails, chat messages, or configuration files. PEM (Privacy-Enhanced Mail) solves this by wrapping the DER bytes in base64 encoding and adding header/footer lines like -----BEGIN CERTIFICATE-----. The result is about 33% larger but works everywhere: you can paste it into a terminal, email it, include it in a YAML file, or concatenate multiple certificates into a single chain file.

This converter handles both directions. Give it a DER binary file and it produces PEM text you can copy. Give it PEM text and it produces a DER file you can download. It auto-detects the content type (certificate, private key, CSR, or public key) and applies the correct PEM header/footer. No need to remember whether it is openssl x509, openssl rsa, or openssl req with the right -inform and -outform flags.

How to Convert Between DER and PEM

1. For DER to PEM: upload or drag-drop your binary .der, .cer, or .crt file
2. For PEM to DER: paste the PEM text including the -----BEGIN/END----- lines
3. The converter auto-detects the input format and content type (certificate, key, or CSR)
4. Copy the PEM output or download the DER binary file

DER vs. PEM Format Comparison

Example Conversion

PEM to DER

Input (PEM):

-----BEGIN CERTIFICATE-----
MIIFjTCCBHWgAwIBAgISA0M4rfJGaXD0dC/jC+/SUoZfMA0GCSqGSIb3
DQEBCwUAMDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNy
...base64 data...
-----END CERTIFICATE-----

Output: Binary .der file download (typically 1--2 KB for a leaf certificate)

DER to PEM

Input: Upload binary .der file

Output (PEM):

-----BEGIN CERTIFICATE-----
MIIFjTCCBHWgAwIBAgISA0M4rfJGaXD0dC/jC+/SUoZfMA0GCSqGSIb3
...base64 encoded content...
-----END CERTIFICATE-----

When to Use This Tool

• Windows to Linux migration -- Windows Certificate Store exports in DER format; Apache and nginx require PEM
• Java keystore operations -- Java's keytool imports and exports DER; many configuration steps require PEM
• Certificate inspection -- convert DER to PEM so you can paste it into certificate viewers, fingerprint generators, or other analysis tools
• Email-safe sharing -- convert binary DER files to PEM text that can be safely pasted into emails or chat messages
• Script automation prep -- PEM format works with openssl, curl --cacert, and most command-line tools that expect text-based certificates
• Cross-platform certificate deployment -- prepare certificates in the right format for each target system in your infrastructure

How DER and PEM Encoding Work

DER (Distinguished Encoding Rules)

DER is the binary encoding of ASN.1 data structures defined by X.690. It produces a unique, deterministic byte sequence for any given ASN.1 structure. A DER-encoded certificate is the raw bytes -- not readable in a text editor but compact and unambiguous.

PEM (Privacy-Enhanced Mail)

PEM wraps DER in a text-safe format through three steps:

1. Start with the DER binary data
2. Encode it using base64 (converting binary to ASCII characters)
3. Add header and footer lines identifying the content type

The header/footer lines indicate what the PEM block contains:

Platform Format Preferences

Format Conversion in Practice

The most common conversion scenario is moving certificates from Windows to Linux. When you export a certificate from Windows Certificate Manager, it defaults to DER format with a .cer extension. If you try to use this file with nginx or Apache, you will get a cryptic error about the certificate format being invalid. The fix is simple: convert to PEM. But if you do not have OpenSSL installed on your Windows machine (and many Windows administrators do not), this web-based converter saves you from installing additional tools.

The reverse conversion -- PEM to DER -- is most common when working with Java applications. Java's keytool utility imports certificates in DER format by default, and while it supports PEM in newer versions, many older deployment scripts expect DER. Similarly, importing a certificate into the Windows Certificate Store or macOS Keychain is often easier with a DER file that you can double-click to launch the import wizard.

One thing to watch for is the ambiguous .cer file extension. Unlike .pem (always PEM) or .der (always DER), a .cer file can be either format. If someone sends you a .cer file and you are not sure what format it is, open it in a text editor. If you see -----BEGIN CERTIFICATE----- and readable base64 characters, it is PEM. If you see binary characters, it is DER. On Linux, the file command will also tell you: file cert.cer reports either "PEM certificate" or "data" for DER.

Frequently Asked Questions

How do I tell if a .cer file is DER or PEM? Open the file in a text editor. If you see -----BEGIN CERTIFICATE----- and readable base64 text, it is PEM. If you see binary garbage characters, it is DER. The .cer extension is ambiguous and can be either format. On the command line, file cert.cer will report "PEM certificate" or "data" (for DER).

Can I convert PKCS#12 (.pfx/.p12) files with this tool? This tool handles DER and PEM conversions. PKCS#12 is a different container format that bundles certificates with private keys and is password-protected. To work with PKCS#12 files, use OpenSSL: openssl pkcs12 -in file.pfx -out combined.pem -nodes extracts all contents as PEM.

Why is my DER file larger than expected? The DER format should be smaller than PEM (no base64 overhead). If your DER file seems large, it may contain multiple certificates or a private key. Single leaf certificates in DER format are typically 1--2 KB. Certificate chains should be stored in PEM format since DER does not support concatenation.

Does converting between DER and PEM change the certificate's fingerprint? No. The fingerprint is always computed over the DER-encoded data, regardless of whether the certificate is stored as DER or PEM. Converting between formats preserves the underlying DER bytes, so the fingerprint remains identical.

Can I concatenate multiple DER certificates into a chain? No. DER format only supports a single certificate per file. To create a chain (bundle), you must convert each DER certificate to PEM format first, then concatenate the PEM blocks into a single file. Use the PEM Bundle Merger to assemble them in the correct order.

Related Tools

• X.509 Certificate Viewer - View certificate details after converting to PEM
• PEM Bundle Splitter - Split concatenated PEM certificates after conversion from DER
• PEM Bundle Merger - Merge individually converted PEM certificates into a chain
• Certificate Fingerprint Generator - Generate fingerprints from PEM certificates
• CSR Viewer - View CSR details after converting from DER to PEM