Skip to content
MtrXTools

SSL converter

Convert certificates, CSRs and keys between PEM and DER, change private keys between PKCS#1, PKCS#8 and EC formats, remove or add a passphrase, extract certificates from a P7B, and check that a private key matches a certificate. Runs in your browser.

What it converts

  • Certificates and CSRs between PEM (-----BEGIN CERTIFICATE-----) and binary DER (.cer, .der), and certificates out of a PKCS#7 bundle (.p7b, .p7c), as Windows and some CAs deliver them.
  • Private keys between PKCS#8 (BEGIN PRIVATE KEY), PKCS#1 (BEGIN RSA PRIVATE KEY) and SEC1 (BEGIN EC PRIVATE KEY), since some servers and libraries accept only one of them.
  • Encrypted keys: decrypts BEGIN ENCRYPTED PRIVATE KEY (AES or 3DES) and the older OpenSSL Proc-Type: 4,ENCRYPTED format, and can encrypt a key with a new passphrase.
  • The public key of any private key, and RSA public keys in either format.

Does the key match the certificate?

Paste the certificate and the private key together. The converter works out the key's public half and compares it with the certificate's (or a CSR's). A mismatch is the usual reason for "key values mismatch" in Nginx, "SSL_CTX_use_PrivateKey failed" or a server that won't start after a renewal: the certificate was issued for a CSR made with a different key.

Keys are processed only in your browser: nothing is uploaded, stored or put in the address bar. Each conversion also has its OpenSSL command, for doing it on the server instead.

Questions

What is the difference between .crt, .cer and .pem?
Mostly the file extension. .pem files are text (base64 between BEGIN and END lines); .der files are binary; .crt and .cer can be either, depending on who made them. The converter detects which one you have.
What is the difference between PKCS#1 and PKCS#8?
PKCS#1 (BEGIN RSA PRIVATE KEY) is an RSA-only format. PKCS#8 (BEGIN PRIVATE KEY) wraps a key of any algorithm with its type, and is what OpenSSL 3 and most modern software write. Older software, such as some Java and PHP libraries, may need one or the other.
How do I remove the passphrase from a key?
Paste the encrypted key, enter the passphrase and copy the decrypted PKCS#8 or RSA version. A server that starts unattended needs an unencrypted key, so keep its file readable only by the server.

Related tools