PEM to DER Converter (Certificates and Keys)

How to convert PEM to DER

1. Paste the PEM block into the input, or drop a .pem, .crt, .key or .csr file.
2. Pick the output under Convert to:
   • DER – one-line Base64: the PEM body without header lines and line breaks, ready for a JSON field or an environment variable.
   • DER – hex: the same bytes as hex, for byte arrays and protocol traces.
   • PEM (64 columns) and Public key (PEM) are there for the reverse direction and for extracting a public key.
3. Click Download .der to save the binary file, or Copy output for the text form.

The converter detects certificates, CSRs, CRLs, public keys and private keys (PKCS#1, PKCS#8, SEC1 EC), so there is nothing to choose for the input type.

What the conversion does

PEM is a text wrapper around DER. Take this certificate (shortened):

-----BEGIN CERTIFICATE-----
MIIBtzCCAV2gAwIBAgIUfX6gOa1S96OttEsj3WbuIdu0cE0wCgYIKoZIzj0EAwIw
...
-----END CERTIFICATE-----

Drop the two marker lines, join the remaining lines, Base64-decode, and you have the DER file: here 443 bytes starting 30 82 01 b7, the ASN.1 SEQUENCE header. The label in the marker lines is the only information that disappears. DER files carry no label, which is why tools that read DER either need to be told what the file is or have to guess from its structure.

Where you need DER

• Embedded devices and firmware: certificates compiled into C as a byte array are almost always DER. Use the hex output and paste it into an array.
• Apple platforms: SecCertificateCreateWithData takes DER data, not PEM text.
• The x5c parameter of a JWK and the <ds:X509Certificate> element in SAML metadata hold Base64 DER without PEM headers.
• CA Issuers URLs in certificates usually serve a DER .cer file.
• Windows: .cer files can be either form, but some older import dialogs and appliances only accept DER.

PEM to DER with OpenSSL, Python and certutil

openssl x509 -in cert.pem -outform der -out cert.der
openssl req  -in app.csr  -outform der -out app.der
openssl pkey -in key.pem  -outform der -out key.der
grep -v -- '-----' cert.pem | tr -d '\n'

The last line prints the one-line Base64 DER of a single-certificate file. In Python, ssl.PEM_cert_to_DER_cert(open("cert.pem").read()) returns the DER bytes of a certificate. On Windows, certutil -decode cert.pem cert.der strips the markers and decodes. More in Base64 with OpenSSL and Base64 in Python.

Common problems

• Several blocks in one file: the text outputs convert every block, but Download .der saves only the first object, because a DER file holds exactly one. Split the chain first or download each certificate from its card in the certificate decoder.
• -----BEGIN ENCRYPTED PRIVATE KEY-----: converts fine, but the DER is still encrypted. Decrypting needs the password and is not done here.
• Proc-Type: 4,ENCRYPTED headers: legacy OpenSSL encryption has no DER form. Run openssl pkey -in key.pem -out plain.pem with the password first.
• -----BEGIN OPENSSH PRIVATE KEY-----: not ASN.1 at all, so there is no DER to produce. Use the SSH key tool for its public key.

FAQ