SSL Converter
Convert between PEM, PKCS#12 (PFX) and PKCS#7 — locally in your browser.
Runs 100% in your browser — nothing you paste or generate ever leaves your device.
Convert certificates and keys between PEM, PKCS#12 (PFX) and PKCS#7 — entirely offline.
3DES is the default for maximum compatibility; AES-256 PKCS#12 may not open in older tools.
Quick answer
SSL Converter changes certificates and keys between PEM, DER, PKCS#12 (PFX), and PKCS#7 entirely in your browser, so the private key is never uploaded. Use it to build a PFX for IIS, extract PEM for a load balancer, or produce PKCS#7 for a Java keystore.
SSL Converter changes a certificate and key between the formats different platforms demand: PEM, DER, PKCS#12 (PFX), and PKCS#7. It runs entirely in your browser, so your certificate and, crucially, your private key are never uploaded. Converting a PFX means handling the private key, and doing that on a remote server hands your most sensitive material to a third party. Here the conversion happens locally, and nothing you paste or drop in leaves the page.
The reason this tool exists is that the certificate world has no single format. Apache and NGINX and most load balancers want PEM. Windows and IIS want a single password-protected PKCS#12 (PFX) file that bundles the certificate and private key together. Java keystores and some Windows imports expect PKCS#7. Your CA might hand you DER. This converter moves between them so you can take what you were given and produce exactly what your server needs.
Local conversion, private key never uploaded
Every transformation happens in your browser. When you build a PFX you provide the certificate, the chain, and the private key, and all of it is combined locally into the encrypted output; none of it is transmitted. This is the difference that matters: a PFX contains your private key, so a server-side converter necessarily sees your secret. Converting locally means you can safely repackage production certificates without ever exposing the key that protects them.
PEM vs DER
PEM and DER hold the same certificate in different encodings. PEM is base64 text with -----BEGIN CERTIFICATE----- header lines, is easy to copy and paste, and is what Apache, NGINX, HAProxy, and most Linux services expect. DER is the raw binary equivalent, seen in .der and .cer files and favored by some Windows and Java tooling. Converting PEM to DER just base64-decodes the body; converting back re-encodes it. Choose the one your target software documents.
PKCS#12 (PFX) vs PKCS#7
These two bundles serve opposite needs. PKCS#12, also called PFX (.pfx/.p12), packages the certificate, its chain, and the private key into one password-protected file; it is what IIS and Windows import when you install a certificate, because Windows wants the key and certificate together. PKCS#7 (.p7b/.p7c) carries certificates only, no private key, and is used to move a certificate plus its chain into Java keystores, Tomcat, or Windows certificate stores. If you need the key inside, use PFX; if you only need the certificate chain, use PKCS#7.
When you need each format
Going to IIS or a Windows server, or importing into Azure and many cloud load balancers: build a PKCS#12 (PFX) from your PEM certificate, chain, and key. Deploying to Apache, NGINX, or an AWS or GCP load balancer: use PEM, often with the key and certificate as separate files. Loading a chain into a Java keystore or Tomcat: PKCS#7 is common. Extracting the certificate and key out of a PFX you were given: convert PFX to PEM to get the individual files.
Frequently asked questions
- Is my private key uploaded when I build a PFX?
- No. The PFX is assembled in your browser from the certificate, chain, and key you supply, and none of it is transmitted. Because a PKCS#12 file contains the private key, this local-only behavior is exactly why you should avoid server-side PFX converters, which would receive your key on a machine you do not control.
- What is a PFX file and when do I need one?
- A PFX (PKCS#12) is a single password-protected file that bundles a certificate, its chain, and the private key together. You need it mainly for Windows and IIS, which import the certificate and key as one unit, and for many cloud services that accept a PFX upload. It is the go-to when a platform wants the certificate and key in the same file.
- What is the difference between PKCS#12 and PKCS#7?
- PKCS#12 (PFX) contains the private key along with the certificate and chain, so it is used to install a certificate where the key is needed, like IIS. PKCS#7 (.p7b) contains only certificates, no private key, and is used to move a certificate and its chain into Java keystores, Tomcat, or Windows certificate stores. Choose PFX when the key must travel with the certificate.
- My load balancer wants PEM but my CA gave me a PFX, how do I convert?
- Convert the PFX to PEM here. You supply the PFX and its password, and the tool extracts the certificate, the intermediate chain, and the private key as separate PEM blocks. Give the certificate and chain to the load balancer as its certificate, and the private key as its key, which is the format Apache, NGINX, AWS, and GCP expect.
- Do I need a password on a PFX?
- A PKCS#12 file is designed to be password-protected because it holds your private key, and most systems expect a password on import. Choose a strong one and store it with the file. When you later convert the PFX back to PEM, you must supply that same password to unlock the key inside.
- What is the difference between .cer, .crt, .pem, and .der files?
- These extensions describe encoding, not content. .pem and usually .crt are PEM text (base64 with header lines). .der is raw binary. .cer can be either PEM or DER depending on who produced it. If a file opens as readable base64 text it is PEM; if it looks like binary garbage it is DER. Convert to whatever your target software documents.