OpenSSL is used for many things other than running encryption on a website. It is also used for the generation of CSR keypairs, and more importantly within this article converting.

The Italic parts in the conversions below are examples of you own files, or your own unique naming conventions adapt these Italic name examples to your own files names for openssl commands.
Note: .pem, .cer, crt. are all the same type of x509/pem certificate only with different extensions.

Obtain OpenSSL:

Note: In order for OpenSSL software successfully installed on a computer system. You must have local system administrator privilege on the computer.

  1. Download and install OpenSSL to perform a certificate conversion.

Use the following OpenSSL commands to convert SSL certificate to different formats on your own machine

OpenSSL Commands-

OpenSSL Convert PEM

Convert PEM to DER:

openssl x509 -outform der -in certificate.pem -out certificate.der

Convert PEM to P7B:

openssl crl2pkcs7 -nocrl -certfile certificate.cer -out certificate.p7b -certfile CACert.cer

Convert PEM & Private Key to PFX/P12:

openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt

OpenSSL Convert DER

Convert DER to PEM:

openssl x509 -inform der -in certificate.der -out certificate.pem

OpenSSL Convert P7B

Convert P7B to PEM:

openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer

Convert P7B to PFX:

openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer

openssl pkcs12 -export -in certificate.cer -inkey privateKey.key -out certificate.pfx -certfile CACert.cer

OpenSSL Convert PFX

Convert PFX to PEM and Private Key

openssl pkcs12 -in certificate.pfx -out certificate.cer -nodes

Remove Private key password

openssl rsa -in file.key -out file2.key

Enter the passphrase and [file2.key] is now the unprotected private key.

The output file:  [file2.key] should be unencrypted. To verify this open the file using a text editor (such as MS Notepad) and view the headers

If you need to convert a Java keystore .jks lets say taking a ssl certificate from a tomcat system and moving it to Apache or Windows and vice versa it is usually easier to just generate a new CSR keypair from those respective systems and perform a reissue of the certificate, but there’s is a way by using a conversion application such as Portecle.

About SSL2048:

SSL2048 is part of Acmetek who is a Symantec Website Security Solutions Authorized Distributor and a Platinum Partner. Acmetek offers all 4 Brands of SSL Certificates, Symantec, Thawte, GeoTrust and RapidSSL.Offering Norton Shopping Guarantee that inspires trust and increases online sales with a 20x ROI Guarantee.

Contact an SSL Specialist to buy your SSL Certificates from Acmetek, a Symantec Strategic/Platinum Distributor.

Become a Partner and create additional revenue stream while the heavy lifting for you.