SSL certificate formats and conversion

A TLS certificate is data, and how that data is encoded on disk changes whether a server can read it. The same certificate can exist as PEM, DER or PKCS12, and failing to match the format a server expects is one of the most common causes of "certificate file not found" and password-prompt errors despite the certificate being valid. Knowing the formats and the OpenSSL commands to convert them resolves those quickly.

Formats compared

• PEM is base64 text inside -----BEGIN CERTIFICATE----- fences. Everything that supports X.509 accepts it, and it is the default for Apache, Nginx and most Linux tools. PEM can hold multiple objects in one file, so a certificate chain and a private key can live in separate PEM files.
• DER is the same data in raw binary without base64 or fences. Windows tools and some Java stores use it. A .cer or .crt file may actually contain DER even when the extension suggests PEM, which is why opening it in a text editor shows garbage.
• PKCS12 (.p12 / .pfx) bundles the certificate, any chain, and the private key into one binary file encrypted with a password. Windows IIS and many web servers imported through a GUI use it. A PKCS12 you did not author almost always prompts for a password.

Conversion basics

All conversion runs through OpenSSL. To read what is inside an unknown file first, without changing it:

openssl x509 -in cert.crt -text

To convert PEM containing both key and certificate into a PKCS12:

openssl pkcs12 -export -out combined.pfx -inkey key.pem -in cert.pem -certfile chain.pem

To extract the certificate and key from a PKCS12 back to PEM:

openssl pkcs12 -in combined.pfx -out key+chain.pem -nodes

The -nodes flag leaves the key unencrypted, which is what a web server like Nginx needs when reading the key directly. To get DER from PEM, or PEM from DER:

openssl x509 -in cert.pem -outform der -out cert.der
openssl x509 -inform der -in cert.der -out cert.pem

Which to use

PEM with the key stored separately is the normal choice for web servers on Linux. Reach for PKCS12 only when the target tool explicitly expects it, most commonly Windows or an appliance that imports the private key through a browser or administrator console. DER appears when an old tool or an intermediate step needs the bare binary certificate. The private key never changes format semantics across these; PEM and PKCS12 differ mainly in whether the key travels inside the same file and how it is encrypted.

Chain and key hygiene

When converting, check that the file you produce includes any intermediate certificates, because a server with a PEM file that holds only the leaf certificate fails the handshake for every client that lacks the trusted intermediate. An incomplete chain is the silent failure that survives a format conversion. Take a sanity check after converting by hosting the file on the server and reading it back, or by running a server config test such as nginx -t, which reports an unreadable key or certificate immediately.

Related certificate work

Retiring and reusing a certificate between hosts is where format mismatches bite hardest. Compare this with the renewal checklist to see the steps that keep a fresh key and chain consistent across every server that needs them.