How to convert PEM and DER certificates using OpenSSL

Certificate files often move between Unix-style TLS services, appliances, Java tools, and certificate portals that expect different encodings. A PEM file wraps the binary X.509 certificate in base64 text with BEGIN and END lines, while DER stores the same certificate as raw ASN.1 bytes for software that does not accept PEM text.

OpenSSL handles certificate encoding changes through the x509 command. PEM input is the default, DER input must be named with -inform DER, and the requested output encoding is selected with -outform PEM or -outform DER. The conversion changes the file wrapper, not the subject, issuer, serial number, public key, validity dates, or fingerprint.

PEM-to-DER and DER-to-PEM conversion is for a single X.509 certificate file such as server.pem, server.crt, server.cer, or server.der. Certificate chains, PKCS#12/PFX bundles, private keys, and trust validation are separate tasks; checking the fingerprint after conversion confirms the output still describes the same certificate.

Related: How to view certificate details using OpenSSL
Related: How to check a certificate fingerprint using OpenSSL
Related: How to convert a PFX file to PEM using OpenSSL
Tool: SSL Certificate Converter

Steps to convert PEM and DER certificates using OpenSSL:

  1. Inspect the source PEM certificate before changing the encoding. 
    $ openssl x509 -in server.pem -noout -subject -issuer -serial -fingerprint -sha256
subject=CN=server.example.com
issuer=CN=server.example.com
serial=1001
sha256 Fingerprint=31:57:DE:EE:3C:CF:43:AE:3F:1D:46:6E:B5:0D:EB:4D:E7:AA:72:75:6F:AE:4B:A3:9D:7D:A6:CD:A1:04:46:A5

    Add -inform DER when the source certificate is already a DER file.

  2. Convert the PEM certificate to DER encoding. 
    $ openssl x509 -in server.pem -outform DER -out server.der

    OpenSSL prints no output when the conversion succeeds. The DER file is binary, so inspect it with OpenSSL instead of pasting it into a text editor.

  3. Inspect the converted DER certificate. 
    $ openssl x509 -inform DER -in server.der -noout -subject -issuer -serial -fingerprint -sha256
subject=CN=server.example.com
issuer=CN=server.example.com
serial=1001
sha256 Fingerprint=31:57:DE:EE:3C:CF:43:AE:3F:1D:46:6E:B5:0D:EB:4D:E7:AA:72:75:6F:AE:4B:A3:9D:7D:A6:CD:A1:04:46:A5

    The subject, issuer, serial number, and SHA-256 fingerprint should match the source certificate.

  4. Convert the DER certificate back to PEM when a text certificate is required. 
    $ openssl x509 -inform DER -in server.der -outform PEM -out server-from-der.pem
  5. Inspect the back-converted PEM certificate. 
    $ openssl x509 -in server-from-der.pem -noout -subject -issuer -serial -fingerprint -sha256
subject=CN=server.example.com
issuer=CN=server.example.com
serial=1001
sha256 Fingerprint=31:57:DE:EE:3C:CF:43:AE:3F:1D:46:6E:B5:0D:EB:4D:E7:AA:72:75:6F:AE:4B:A3:9D:7D:A6:CD:A1:04:46:A5

    Matching values confirm that only the certificate encoding changed.