How to Convert SSL and TLS Certificates Between PEM, DER, and PKCS#12 Formats in Linux Using OpenSSL

Deploying SSL and TLS certificates across varied web servers, containerised clusters, and enterprise systems frequently encounters format incompatibilities. While web applications running on Apache, Nginx, or HAProxy expect text-based PEM files, Java applications frequently require binary DER files, and Microsoft Windows servers or Azure key vaults demand bundled PKCS#12 (.pfx or .p12) archives. Fortunately, the standard OpenSSL command-line toolkit included in almost every Linux distribution provides fast, reliable utilities to transform certificates seamlessly. Learning how to convert certificate formats in Linux using OpenSSL ensures you can deploy cryptographic keys across any infrastructure without error.

Understanding Common Certificate Formats and Extensions

Before executing conversion commands, it is essential to recognise the cryptographic standards underlying common certificate extensions:

• PEM (Privacy Enhanced Mail): The most prevalent format on Unix and Linux servers. PEM files are Base64-encoded ASCII containers bounded by headers such as -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----. Common extensions include .crt, .pem, .cer, and .key.
• DER (Distinguished Encoding Rules): A binary representation of the ASN.1 certificate structure. Unlike PEM, DER files cannot be opened in a standard text editor. Common extensions include .der and .cer (frequently used in Java keystores and embedded appliances).
• PKCS#12 (PFX): A password-protected binary container format designed to hold a server certificate, intermediate chain certificates, and the matching private key inside a single secure file. Common extensions include .pfx and .p12.

Converting Between PEM and DER Formats

Transforming standalone certificates between ASCII PEM and binary DER involves standard OpenSSL encoding operations.

Converting PEM to DER

To convert an ASCII-encoded certificate into binary DER format, execute the following command:

openssl x509 -in certificate.pem -outform der -out certificate.der

To convert a private key from PEM to DER:

openssl rsa -in privatekey.pem -outform der -out privatekey.der

Converting DER to PEM

To convert a binary DER certificate into a standard readable PEM file:

openssl x509 -in certificate.der -inform der -out certificate.pem

To convert a binary DER private key back into PEM format:

openssl rsa -in privatekey.der -inform der -out privatekey.pem

Converting PEM Certificates and Keys to PKCS#12 (.pfx / .p12)

When migrating an SSL/TLS certificate from a Linux environment to Windows IIS, Microsoft Exchange, or an enterprise load balancer, you must combine the leaf certificate, private key, and certificate authority (CA) bundle into a single PKCS#12 container.

openssl pkcs12 -export -out server_bundle.pfx -inkey privatekey.key -in certificate.crt -certfile ca_chain.crt

During execution, OpenSSL will prompt you to define an Export Password. This password encrypts the bundled private key, ensuring secure transit across untrusted storage media or administrative networks.

Extracting PEM Certificates and Keys from PKCS#12 (.pfx / .p12)

Conversely, if you receive a .pfx archive from an IT department or commercial certificate provider and need to deploy it to an Nginx or Apache server on Ubuntu or Debian, you must extract the distinct components.

Extracting the Private Key

To extract the private key while stripping the password for unattended server reboots:

openssl pkcs12 -in server_bundle.pfx -nocerts -out privatekey.pem -nodes

The -nodes (no DES) flag ensures that the resulting private key is stored unencrypted so automated services can read it during startup.

Extracting the Server Certificate

To extract only the primary server certificate:

openssl pkcs12 -in server_bundle.pfx -clcerts -nokeys -out certificate.crt

Extracting the Intermediate and Root CA Chain

To extract only the intermediate and root CA certificates into a bundle:

openssl pkcs12 -in server_bundle.pfx -cacerts -nokeys -out ca_chain.crt

Verifying Certificate Integrity and Matching Keys

Before putting converted files into production, verify that your certificate corresponds mathematically to your private key. Calculate the MD5 checksum of the public moduli for both files:

openssl x509 -noout -modulus -in certificate.crt | openssl md5
openssl rsa -noout -modulus -in privatekey.key | openssl md5

If both output hashes match identically, the certificate and private key are correctly paired and ready for deployment.

Understanding how to convert certificate formats using OpenSSL provides full administrative agility across heterogeneous environments. By applying these standard commands, you can adapt encryption assets reliably between Linux web servers, Windows environments, and enterprise PKI infrastructure.