SSL Converter

Certificate File to Convert

Private Key File

Chain Certificate File (optional)

Chain Certificate File 2 (optional)

Type of Current Certificate

Type To Convert To

PFX Password

Convert Certificate

About SSL Converter

An SSL converter is an online tool that transforms SSL/TLS certificate files between formats like PEM, DER, and PFX (PKCS#12) so they match your server's requirements. ToolsPivot's SSL converter handles the conversion in your browser with no OpenSSL commands, no software installation, and support for optional chain certificates and private key bundling in a single step.

Server migrations and platform changes almost always trigger a certificate format mismatch. You've got a .pem file from your certificate authority, but your Windows IIS server needs a .pfx. Or you're moving from IIS to Apache and need to pull individual PEM files out of a PKCS#12 archive. Running OpenSSL commands to fix this is tedious, error-prone, and assumes you even have OpenSSL installed. ToolsPivot skips that entire process. Upload your files, pick the target format, and download the converted certificate. Done.

How to Use ToolsPivot's SSL Converter

Upload your certificate file: Click the file upload field and select the SSL certificate you need to convert. Supported input types include PEM (.pem, .crt, .cer), DER (.der, .cer), and PFX/PKCS#12 (.pfx, .p12).
Attach your private key (if needed): For conversions that require the private key (like PEM to PFX), upload your .key file in the second field. Skipping this step when converting to PFX will cause the conversion to fail.
Add chain certificates (optional): If your CA provided intermediate or root certificates, upload them in the chain certificate fields. ToolsPivot accepts up to two chain certificate files.
Select your current format: Choose the format of your uploaded file from the dropdown: Standard PEM, DER/Binary, or PFX/PKCS#12. You can also let the tool auto-detect it from the file extension.
Choose the target format: Pick the format you need: Standard PEM, DER/Binary, or PFX/PKCS#12. If converting to PFX, enter a password in the PFX Password field to protect the output file.
Click "Convert Certificate": ToolsPivot processes the conversion and provides your certificate in the new format, ready to download and install on your server.

ToolsPivot's SSL Converter Features

Three-format support: Converts between PEM, DER/Binary, and PFX/PKCS#12. These three formats cover the vast majority of web server and application requirements, from Apache and Nginx to IIS and Tomcat.
Auto-detection from file extension: Not sure what format your certificate is in? The tool can detect it automatically based on the file extension (.pem, .crt, .der, .pfx, .p12), so you don't need to guess.
Private key bundling: When creating a PFX file, the converter bundles your certificate, private key, and chain certificates into a single password-protected archive. No need to run separate OpenSSL commands for each step.
Chain certificate support: Accepts up to two chain certificate files (intermediate and root CA certificates), which is critical for building a complete trust chain that browsers and servers validate. You can verify your chain separately with the SSL checker.
PFX password protection: When converting to PKCS#12/PFX format, the tool lets you set an export password. This follows the PKCS#12 standard (defined in RFC 7292) for encrypting the archive that holds your private key.
No software required: Runs entirely in the browser. You don't need to install OpenSSL, download a desktop app, or touch the command line. Upload, convert, download.

Which Format Does Your Server Need?

Different servers and platforms expect certificates in specific formats. Picking the wrong one triggers installation errors, and the error messages are rarely helpful. Here's a quick reference so you can choose the right conversion target before you start.

Server / Platform	Required Format	File Extensions
Apache, Nginx, Linux servers	PEM	.pem, .crt, .cer, .key
Microsoft IIS, Exchange, Azure	PFX / PKCS#12	.pfx, .p12
Java Tomcat, JBoss, WebLogic	DER or Java Keystore (JKS)	.der, .cer, .jks
AWS Certificate Manager	PEM	.pem, .crt
Google Cloud, Cloudflare	PEM	.pem, .crt
cPanel / Plesk	PEM	.crt, .key
iOS configuration profiles	PFX (TripleDES)	.pfx, .p12

If you're migrating from Apache to IIS, you'll need to convert PEM to PFX and bundle your private key. Going the other direction (IIS to Apache) means extracting the PEM certificate and key from the PFX archive. Before installing, run your domain through ToolsPivot's server status checker to confirm the server is reachable.

PEM, DER, and PFX: What's Actually Different

These aren't just different file extensions. Each format stores certificate data in a fundamentally different way, and understanding the difference saves you from failed installations and confusing error messages.

PEM (Privacy Enhanced Mail) is the most common format you'll encounter. It's a Base64-encoded text file, which means you can open it in any text editor and see the "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" markers. Certificate authorities like Let's Encrypt, DigiCert, and Sectigo issue certificates in PEM format by default. A single .pem file can hold the server certificate, intermediate certificates, and even the private key (though best practice keeps the key in a separate .key file). Apache, Nginx, and most Linux-based servers expect PEM files.

DER (Distinguished Encoding Rules) is the binary version of PEM. Same data, different encoding. Open a DER file in a text editor and you'll see unreadable characters because it's raw binary, not Base64. Java-based platforms (Tomcat, JBoss, WebLogic) frequently use DER format. Windows also recognizes DER files with the .cer extension, which creates confusion because PEM files can also use .cer. The only reliable way to tell them apart? Open the file in a text editor and check for the BEGIN/END markers.

PFX / PKCS#12 is a password-protected binary archive that bundles the server certificate, private key, and intermediate certificates into one file. This is what Windows servers (IIS, Exchange, Azure App Service) expect. The format is defined in RFC 7292 and uses either TripleDES or AES encryption. When you generate a CSR on a Windows server, you'll typically export the resulting certificate as a .pfx file.

Why Use ToolsPivot's SSL Converter

Skip the command line: OpenSSL conversion commands are long, easy to mistype, and require you to have OpenSSL installed. ToolsPivot replaces multi-step terminal commands with a single upload-and-click process.
No account required: Most competing SSL converters either require registration or sit behind a paywall for batch conversions. ToolsPivot converts certificates without asking for an email address or credit card.
Bundle everything in one step: Converting PEM to PFX normally takes three inputs (certificate, key, chain) and a multi-flag OpenSSL command. ToolsPivot has separate upload fields for each file, so you don't need to figure out the right command syntax. Pair this with the certificate key matcher to confirm your key matches your certificate before converting.
Auto-detect saves guesswork: Certificate files come with confusing overlapping extensions (.cer can be PEM or DER, .crt can be either format). The auto-detection feature figures out what you've uploaded, so you don't have to.
Part of a full SSL toolkit: After converting your certificate, decode the contents using the certificate decoder, validate your CSR with the CSR checker, or run a full site audit to confirm everything checks out. That's the full certificate lifecycle in one place.
Works on any device: Browser-based means it works on Windows, macOS, Linux, and even mobile. No platform-specific software needed.

Common Conversion Scenarios

Migrating from Apache to Windows IIS

Apache uses separate PEM files for the certificate (.crt) and private key (.key). IIS requires a single PFX archive containing both. Upload your .crt as the certificate, your .key as the private key, and your CA's intermediate certificate as the chain file. Set a PFX password, convert, and import the .pfx into IIS. Before importing, confirm your domain's DNS records point to the new server.

Setting up a Java application server

Java Tomcat and JBoss often need DER-encoded certificates, or you may need to import them into a Java Keystore (JKS). Start by converting your PEM certificate to DER format, then use the Java keytool command to import the DER file into your keystore. ToolsPivot handles the PEM-to-DER step; keytool handles the rest.

Deploying to a cloud platform

AWS Certificate Manager, Google Cloud, and Cloudflare all accept PEM format. If your certificate authority issued a PFX file (common with certificates purchased through Windows-based resellers), convert PFX to PEM first. You'll get separate certificate and key files ready for upload. While you're at it, run a quick website safety check to make sure your domain isn't blacklisted.

Securing a development or staging environment

Developers working with self-signed certificates often need to convert between formats depending on which local server they're testing. A quick PEM-to-PFX conversion lets you test IIS locally, while PEM-to-DER covers Java-based setups. If you're generating test certificates, the password generator can create a strong PFX export password.

Common Questions About SSL Certificate Conversion

Is ToolsPivot's SSL converter free to use?

Yes, the SSL converter is 100% free with no usage limits. You can convert as many certificates as you need between PEM, DER, and PFX formats without creating an account or paying anything.

Can I convert PEM to PFX without a private key?

No. A PFX/PKCS#12 file must contain a private key by definition. If you only have the certificate (no .key file), you can convert PEM to DER instead. To get the private key, check the server where you originally generated your CSR.

What's the difference between PEM and DER format?

PEM files are Base64-encoded text that you can read in a text editor (they start with "-----BEGIN CERTIFICATE-----"). DER files contain the exact same certificate data but in raw binary form. PEM works with Apache and Nginx; DER is common on Java platforms.

Is it safe to upload my private key to an online converter?

For production certificates protecting sensitive user data, converting locally with OpenSSL is the most cautious approach. For internal certificates, staging environments, or non-sensitive deployments, online converters are a practical shortcut. Never share your private key over unencrypted connections.

How do I know which SSL certificate format I have?

Open the file in a text editor. If you see readable text starting with "-----BEGIN CERTIFICATE-----", it's PEM. If the file looks like garbled binary, it's DER. If the file extension is .pfx or .p12, it's PKCS#12. ToolsPivot's auto-detect feature can also identify the format from the file extension.

Does the converter support P7B/PKCS#7 format?

ToolsPivot's SSL converter supports PEM, DER, and PFX formats. P7B/PKCS#7 is not available as an input or output option. If you need P7B conversion, you'll need to use the OpenSSL command: openssl crl2pkcs7 -nocrl -certfile certificate.pem -out certificate.p7b.

Can I convert a wildcard or multi-domain SSL certificate?

Yes. The converter handles any X.509 certificate regardless of type: single domain, wildcard (*.example.com), multi-domain (SAN), or extended validation (EV). The conversion process is the same for all certificate types.

What PFX password should I use?

Use a strong, unique password with at least 12 characters mixing uppercase letters, lowercase letters, numbers, and symbols. You'll need this password when importing the PFX file into your server (IIS, Azure, Exchange). Use ToolsPivot's password strength checker to test your password before setting it.

Why does my PFX conversion keep failing?

The most common cause is a private key that doesn't match the certificate. The key must be the same one used to generate the original CSR. Use the certificate key matcher in ToolsPivot's hosting checker suite to confirm your server setup, and verify the key match before attempting the conversion again. Another common issue: uploading a chain certificate in the private key field by mistake.

Can I convert SSL certificates on my phone?

Yes. ToolsPivot's converter runs in any modern mobile browser (Safari, Chrome, Firefox). Upload your files, select formats, and download the result. It works the same way as on desktop, just with a smaller screen. Ideal for quick fixes when you're away from your workstation.