Overview
The certificate file (*.pem) in the PEM format consists of the Base64-encoded binary content, the starting line (-----BEGIN CERTIFICATE-----), and the ending line (-----END CERTIFICATE-----). This topic describes how to convert HTTPS certificates in different formats to the PEM format.
Background information
Convert CER or CRT format certificates to PEM format
For certificates in CER or CRT format, you can directly modify the certificate file name extension to convert them into PEM format. For example, you can rename the server.crt certificate file to server.pem.
Convert certificates in the PFX format to the PEM format
Certificates in PFX format generally appear in Windows Server servers. You can use the OpenSSL tool to convert them. Run the following two OpenSSL commands to convert a PFX format certificate into a PEM format certificate:
- Command to extract only the private key file:
openssl pkcs12 -in [$Cert_Name.pfx] -nocerts -out key.pem -nodesNote:
- [$Cert_Name.pfx] is the PFX format certificate to be converted.
- key.pem is the extracted private key file.
- Command to extract only the public key file:
openssl pkcs12 -in [$Cert_Name.pfx] -nokeys -out cert.pemNote :cert.pem is the extracted public key file.
- Commands to extract public and private key merge files:
openssl pkcs12 -in [$Cert_Name.pfx] -nodes -out all.pem
Convert certificates in the P7B format to the PEM format
P7B certificates are generally available in Windows servers and Tomcat servers. You can use the OpenSSL tool to convert certificates. Follow these steps to convert a P7B format certificate to a PEM format certificate.
- Run the following command to convert the P7B format certificate file into a CER file:
openssl pkcs7 -print_certs -in [$Incertificat.p7b] -out [$Outcertificate.cer]
Note:
- [$Incertificat.p7b] is the P7B format certificate to be converted.
- [$Outcertificate.cer] is the converted PEM certificate.
- Only the certificate content that starts with "----- BEGIN CERTIFICATE -----" and ends with "----- END CERTIFICATE -----" in the CER file is retained as follows.
-----BEGIN CERTIFICATE-----
MIIE5zCCA8+gAwIBAgIQN+whYc2BgzAogau0dc3PtzANBgkqh......
-----END CERTIFICATE----- - Then change the extension of the CER file to
.pem.
Convert certificates in the DER format to the PEM format
DER format certificates generally appear in the Java platform. You can use OpenSSL tools to convert them into PEM format. By executing the following two OpenSSL commands, the DER format certificate is converted to the PEM format.
- Command to extract only the public key file:
openssl x509 -inform der -in certificate.der -out certificate.pemNote :certificate.der is a certificate in the DER format and certificate.pem is a converted certificate in the PEM format. The specific documents are subject to the actual environment.
- Command to extract only the private key file:
openssl rsa -inform DER -outform PEM -in privatekey.der -out privatekey.pemNote :privatekey.der is a DER certificate. privatekey.pem is a converted PEM certificate. The specific documents are subject to the actual environment.
References
For more information about certificate formats, see What are the mainstream digital certificate formats.
Applicable scope
- Anti-DDoS Pro and Anti-DDoS Premium
- SSL Certificates Service
