DER to PEM Converter for .cer and .der Files

How to convert DER to PEM

1. Drop the .der, .cer or .crt file on the box. Binary input is read as bytes. Instead of a file you can paste one-line Base64 DER, or hex such as 30 82 01 b7 ….
2. Keep Convert to on PEM (64 columns).
3. Leave PEM label on Auto-detect. The converter reads the ASN.1 and writes CERTIFICATE, CERTIFICATE REQUEST, PUBLIC KEY, PRIVATE KEY and so on. Pick a label yourself only if a tool insists on a specific one.
4. Tick Windows line endings (CRLF) if needed, then Copy output or Download .pem.

Switch to Inspect to check what you converted: subject, expiry and fingerprints are on the card.

Where DER files and headerless Base64 come from

All of these become the same PEM. A 443-byte DER certificate turns into a 656-byte PEM: 592 Base64 characters in ten lines, plus the BEGIN and END lines.

The PEM format in brief

RFC 7468 describes what parsers expect, and the output follows it:

-----BEGIN CERTIFICATE-----
MIIBtzCCAV2gAwIBAgIUfX6gOa1S96OttEsj3WbuIdu0cE0wCgYIKoZIzj0EAwIw
...64 characters per line, the last line shorter...
-----END CERTIFICATE-----

• The label in BEGIN and END must match exactly.
• Body lines are 64 characters of standard Base64 with = padding. Input in the URL-safe alphabet (- and _) or without padding is accepted and written out in the standard form.
• Several certificates in one file are concatenated blocks. That is how fullchain.pem and CA bundles are built. To build one, convert each DER certificate and paste the blocks one after another, leaf first.

DER to PEM with OpenSSL, Python and the shell

openssl x509 -inform der -in cert.cer -out cert.pem
openssl pkey -inform der -in key.der -out key.pem
openssl req  -inform der -in app.der -out app.csr

Older OpenSSL builds fail with unable to load certificate if you forget -inform der; recent ones detect DER themselves. For a one-line Base64 string such as an x5c entry:

{ echo '-----BEGIN CERTIFICATE-----'; echo "$B64" | fold -w 64; echo '-----END CERTIFICATE-----'; } > cert.pem

Python has it built in: ssl.DER_cert_to_PEM_cert(open("cert.der", "rb").read()). More recipes are on the OpenSSL and Python pages.

Common problems

• “Not PEM and not valid Base64 DER” or “Not valid DER/ASN.1 at byte …”: the Base64 is damaged, truncated or not DER. A .p12 or .pfx file is DER too, but its contents are encrypted, so convert it with openssl pkcs12 instead.
• Label shows DATA: the structure was not recognized as a certificate, key or request. The bytes are still converted; set the label yourself if you know what they are.
• The file was PEM all along: some .cer files are PEM despite the extension. The output is then the same certificate, re-wrapped, and nothing else needed converting. The certificate decoder shows what is inside.
• You need the reverse: PEM to DER gives a .der download, one-line Base64 or hex.

FAQ