binary encoded

Quick Answer

SSL certificate formats are the different ways a certificate and its private key are stored in a file. The main ones are PEM (Base64 encoded text), DER (binary encoded), PFX or P12 (a password-protected bundle with the private key) and P7B (a chain without a private key). Extensions like .crt and .cer only name the file; the encoding inside is what matters.

Introduction

The first time I installed a certificate on a Windows server, the certificate authority sent me a ZIP with a .crt file, a .ca-bundle file and nothing else. IIS asked for a .pfx. I spent an hour thinking I had downloaded the wrong thing. I hadn’t. I just didn’t understand SSL certificate formats yet.

If you are here, you probably have a similar problem. Your hosting panel wants one file type, your certificate provider gave you another, and every forum answer starts with a different OpenSSL command. The good news is that the whole topic is smaller than it looks. Once you know the difference between encoding and file extension, and which servers want which bundle, almost every certificate error makes sense.

In this guide I walk through every common format, show you how to tell them apart in seconds, and give you the exact commands I use to convert between them. If you would rather skip the terminal, our free SSL certificate converter handles PEM, CER and PFX conversions directly in your browser. It is one of the many free online converter tools we built for exactly this kind of everyday file headache.

What Are SSL Certificate Formats?

SSL certificate formats are standardized ways of packaging an X.509 certificate, and sometimes its private key and chain, into a file that software can read. The certificate data itself is the same everywhere. What changes is how that data is encoded (text or binary) and what else is bundled with it.

It helps to separate three ideas that people often mix up:

1. The certificate structure. Every SSL/TLS certificate follows the X.509 standard. It contains the domain name, the public key, the issuer, validity dates and a signature.
2. The encoding. That X.509 structure can be saved as raw binary (DER) or as Base64 text wrapped in header lines (PEM).
3. The container. Some SSL certificate formats are containers that hold more than one item. PKCS#12 (PFX/P12) can hold the certificate, the private key and the chain together. PKCS#7 (P7B) holds certificates only.

When I explain this to clients, I compare it to a document. The words are the certificate. PEM and DER are like saving it as plain text or as a compressed file. PFX is like zipping the document together with a key and putting a password on the ZIP.

Base64 encoded vs binary encoded certificates

This one distinction solves most confusion around SSL certificate formats.

• Binary encoded (DER): The certificate is stored as raw bytes. If you open it in Notepad, you see unreadable symbols.
• Base64 encoded (PEM): The same binary bytes are converted into readable ASCII characters and wrapped between lines like —–BEGIN CERTIFICATE—– and —–END CERTIFICATE—–.

PEM is literally DER that has been Base64 encoded. If you want to see how that text conversion works under the hood, try pasting a small string into our Base64 encoder and decoder. The same principle turns a binary certificate into the readable block you copy into a hosting panel. I also wrote a separate explainer on how Base64 encoding works if you want the full picture of why data grows by about a third when it is encoded.

The IETF formalized these text labels in RFC 7468 textual encodings, which defines labels such as CERTIFICATE, PRIVATE KEY and PKCS7. That is why every tool, from OpenSSL to Windows, recognizes the same header lines.

SSL Certificate File Types at a Glance

Here is the comparison table of SSL certificate formats I keep pinned for my own work. It covers the SSL certificate file types you will meet on almost any project.

Format	Common extensions	Encoding	Holds private key?	Holds chain?	Typical platforms
PEM	.pem, .crt, .cer, .key	Base64 text	Can (in a separate block or file)	Yes, stacked	Apache, Nginx, Linux, cPanel
DER	.der, .cer	Binary	No (usually)	No	Java, some Windows tools, embedded devices
PKCS#12	.pfx, .p12	Binary, password protected	Yes	Yes	IIS, Windows, Azure, Exchange, Tomcat
PKCS#7	.p7b, .p7c	Base64 or binary	No	Yes	Windows, Java keystores, Tomcat
Private key	.key	Usually Base64 PEM	It is the key	No	Paired with PEM certificates

Two things from this table are worth remembering. First, only PFX/P12 carries the private key inside the same protected file. Second, the same extension (.cer or .crt) can appear in more than one row, which is why extensions alone are unreliable.

SSL Certificate File Extensions: Why .crt and .cer Can Be Anything

SSL certificate file extensions are labels, not proof of what is inside. A .crt file from one certificate authority can be PEM text, while a .crt from another can be binary DER. Windows tends to call certificates .cer, while Linux tools prefer .crt or .pem.

What is a CRT file?

A CRT file is a certificate file, usually containing a single X.509 certificate for your domain or an intermediate CA. In most Linux and Apache setups, a .crt file is PEM encoded, so you can open it in a text editor and see the BEGIN CERTIFICATE header. It does not contain your private key.

What is a CER file?

A CER file is the same idea with a Windows flavor. Windows can export a .cer as either “DER encoded binary X.509” or “Base-64 encoded X.509”. Same extension, two different encodings. In my experience, this is the single most common cause of “unable to load certificate” errors, because someone renamed a binary .cer to .pem and expected it to work.

PEM vs CRT: is there a difference?

The PEM vs CRT question comes up constantly, and the honest answer is that they are not opposites. PEM describes an encoding. CRT describes a file extension. A .crt file is very often a PEM encoded certificate. So when a panel asks for a “PEM certificate” and you have cert.crt, open it first. If you see the BEGIN CERTIFICATE line, it already is PEM, and in most cases you can upload it as is or simply rename it to .pem.

The difference matters only when the .crt is binary. Then you need to convert it from DER to PEM, which I cover below.

The .key file

The .key file holds your private key, normally in PEM format with a header such as —–BEGIN PRIVATE KEY—– or —–BEGIN RSA PRIVATE KEY—–. Treat it like a password. Never email it, never paste it into a public tool you do not trust, and keep a secure backup. If you lose it, the matching certificate becomes useless and you must reissue.

How to Identify a Certificate Format in 30 Seconds

Before converting anything, I always confirm what I actually have, because SSL certificate formats can look identical from the file name alone. Here is my quick routine.

1. Open the file in a plain text editor. If you see —–BEGIN CERTIFICATE—–, it is PEM. If you see random symbols, it is binary (DER or PFX).
2. Count the BEGIN blocks. One block means a single certificate. Two or three blocks mean a chain bundle (your certificate plus intermediates).
3. Look for a key block. A BEGIN PRIVATE KEY section means the file contains the private key too.
4. Check the size and name. A binary file named .pfx or .p12 that asks for a password when opened in Windows is PKCS#12.
5. Confirm with OpenSSL. Run the OpenSSL command below. If it prints certificate details, the file is a PEM certificate.

openssl x509 -in certificate.crt -text -noout

If that command fails with an error about loading the certificate, add -inform der. If it then works, your file is binary DER.

openssl x509 -in certificate.cer -inform der -text -noout

This two-step check has saved me from countless wrong conversions. I also use the output to confirm the domain name in the Subject Alternative Name list. When a client sends me a long URL and I need to be sure which hostname the certificate must cover, I drop it into a URL parser for extracting the hostname and compare the result with the SAN entries.

Which SSL Certificate Format Does Your Server Need?

Knowing the theory is nice. Knowing which SSL certificate formats your platform expects is what actually gets HTTPS working. This is the cheat sheet I use.

Apache and cPanel

Apache uses separate PEM files: one for the certificate, one for the private key, and usually one for the intermediate chain (or the chain appended to the certificate file in newer versions). cPanel asks you to paste the certificate, private key and CA bundle as PEM text into three boxes.

Nginx

Nginx wants PEM too, but it prefers your certificate and intermediates in one file. The official Nginx ssl_certificate directive says the primary certificate goes first, followed by the intermediate certificates, and the private key sits in a separate file referenced by ssl_certificate_key. Getting this order wrong is a classic cause of “incomplete chain” warnings on mobile browsers.

Microsoft IIS and Windows Server

IIS works best with a PFX file because it imports the certificate and private key in one step. If you generated the CSR on the same Windows server, you can complete the request with the .cer file instead. If you generated it elsewhere, you need a PFX.

Microsoft Azure App Service

Azure is strict. Microsoft’s own guide on uploading a password-protected PFX to Azure App Service lists the requirements: the certificate must be exported as a password-protected PFX and include the full chain of intermediate and root certificates. The page also notes that OpenSSL 3 changed the default PFX encryption, and it gives extra flags to keep the file compatible. I cover those flags in the conversion section.

Java, Tomcat and Android

Java applications traditionally used JKS keystores, but modern Java versions handle PKCS#12 keystores well, so a .p12 or .pfx is often the easiest route. Tomcat can point directly at a PKCS#12 file. Some older Java tools still expect DER or P7B for importing CA certificates.

Load balancers, CDNs and hosting panels

Most cloud consoles and CDNs ask for PEM text: the certificate body, the private key and the chain in separate fields. If you only have a PFX, you will need to convert PFX to PEM first.

How to Convert SSL Certificate Formats (OpenSSL Commands I Use)

OpenSSL is the standard tool for converting SSL certificate formats on Linux and macOS, and you can install it on Windows too. Below are the exact commands I reach for, with a short note on when each one applies. Replace the file names with your own.

Convert PEM to PFX

Use this when you have a PEM certificate and key from a Linux server and need to move to IIS, Azure or another Windows system.

openssl pkcs12 -export -out certificate.pfx -inkey private.key -in certificate.crt -certfile ca-bundle.crt

• -export tells OpenSSL to create a PKCS#12 file instead of reading one.
• -inkey is your private key.
• -in is your domain certificate.
• -certfile adds the intermediate chain.

OpenSSL will ask you to set an export password. Use a strong one. This is what makes it a password-protected PFX.

Compatibility tip: OpenSSL 3 encrypts PFX files with AES-256 by default. Some older Windows versions and services cannot read that. If an import fails with a vague “password incorrect” error even though the password is right, rebuild the file with the legacy settings Microsoft documents:

openssl pkcs12 -export -out certificate.pfx -inkey private.key -in certificate.crt -certfile ca-bundle.crt -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -macalg SHA1

Convert PFX to PEM

Use this when you receive a PFX from a Windows admin or a certificate authority and need PEM files for Apache, Nginx or a hosting panel.

Extract everything (certificate, chain and unencrypted key) into one file:

openssl pkcs12 -in certificate.pfx -out certificate.pem -noenc

Extract only the certificate:

openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out certificate.crt

Extract only the private key:

openssl pkcs12 -in certificate.pfx -nocerts -noenc -out private.key

A few notes from experience. The official OpenSSL pkcs12 command reference explains that -nodes is deprecated since OpenSSL 3.0 and -noenc replaces it. Older tutorials still show -nodes, and it usually still works, but -noenc is the current option. If OpenSSL 3 refuses to open an older PFX with an “unsupported algorithm” error, add -legacy to the command, because older files often use RC2 or 3DES encryption that OpenSSL 3 only loads through its legacy provider.

Convert CRT to PEM

First, check the file with the identification routine above.

• If your .crt already shows —–BEGIN CERTIFICATE—–, it is PEM. Rename it to .pem or copy it. No conversion needed.
• If it is binary, convert it:

openssl x509 -in certificate.crt -inform der -out certificate.pem -outform pem

Convert DER to PEM

This is the same operation as converting a binary .crt or .cer:

openssl x509 -in certificate.der -inform der -out certificate.pem

And the reverse, PEM to DER, for Java tools or devices that only accept binary:

openssl x509 -in certificate.pem -outform der -out certificate.der

Convert P7B to PEM

P7B files often arrive from Windows-based certificate authorities. To pull every certificate out as PEM:

openssl pkcs7 -print_certs -in certificate.p7b -out certificate.pem

Remember that a P7B never contains a private key. If you need a PFX from a P7B, you must also have the original private key from when you created the CSR.

Check that a certificate and private key match

Before uploading anything, I confirm the key belongs to the certificate. For RSA keys, both commands should print the same hash:

openssl x509 -noout -modulus -in certificate.crt | openssl md5
openssl rsa -noout -modulus -in private.key | openssl md5

If the hashes differ, the key is from a different CSR, and no conversion will fix it.

Using an SSL Certificate Converter Online

Not everyone has OpenSSL installed, and typing long commands on a production server at midnight is nobody’s idea of fun. An online SSL certificate converter is useful when you need to switch between SSL certificate formats quickly, such as PEM, CER or PFX.

What I look for in any online converter:

• Processing in the browser. Ideally the conversion happens locally so your private key is not uploaded to a server. Our converter at x2xconverter.com works client side for this reason.
• Password support for PFX. It should let you set or enter the PFX password.
• Clear input and output choices. You should pick the source and target format explicitly instead of relying on file extensions.

My honest advice: for public certificates and chains, an online tool is perfectly fine. For private keys on high-value production systems, I still prefer running OpenSSL on a machine I control. Use whichever matches your security policy.

Common Mistakes I See With Certificate Formats

Most certificate problems I troubleshoot are not caused by bad certificates. They come from small mistakes with SSL certificate formats. These are the ones I see most often.

1. Renaming instead of converting. Changing cert.cer to cert.pem does nothing if the file is binary. Convert it properly.
2. Missing intermediate certificates. The site works on your laptop but fails on some phones. The fix is almost always adding the CA bundle to the chain.
3. Wrong chain order. For Nginx and Azure merges, your certificate goes first, then intermediates, then (where required) the root.
4. Losing the private key. The key is created when you generate the CSR. If you generate the CSR on one server and try to install on another, carry the key with you, ideally inside a PFX.
5. Extra spaces or missing lines when pasting PEM. Copying from an email can add spaces or break the BEGIN and END lines. Paste into a plain text editor first.
6. Windows line endings on Linux. A PEM file edited in some Windows editors can carry hidden carriage returns that confuse older tools. Saving with Unix line endings fixes it.
7. Forgetting the PFX password. Store it in your password manager the moment you set it. There is no recovery option.
8. Using an unencrypted key longer than needed. After extracting a key with -noenc, restrict its file permissions and delete temporary copies.

A Real-World Walkthrough: Moving a Certificate From Linux to Windows

Here is a scenario I run into regularly, and it shows how SSL certificate formats change when you switch platforms. I wrote it step by step so you can follow along.

A site has been running on an Ubuntu server with Nginx. The owner wants to move it to a Windows server with IIS, keeping the same certificate until it expires.

1. Collect the files from the Nginx server. Look at the Nginx config to find the ssl_certificate and ssl_certificate_key paths. You will usually find a full chain PEM file and a .key file.
2. Confirm the formats. Open both in a text editor. The chain file shows two or more BEGIN CERTIFICATE blocks. The key file shows BEGIN PRIVATE KEY.
3. Check that they match. Run the modulus comparison above.
4. Build the PFX. Because the chain file already holds the certificate and intermediates, you can pass it directly:

openssl pkcs12 -export -out site.pfx -inkey private.key -in fullchain.pem

1. Set a strong export password and note it securely.
2. Copy site.pfx to the Windows server and import it in IIS Manager under Server Certificates.
3. Bind it to the site on port 443 and test in a browser and with an SSL checker.

If the import complains about the password even though you typed it correctly, rebuild the PFX with the 3DES flags shown earlier. That one detail is the reason many people believe their PFX is corrupt when it is not.

Security Best Practices When Handling Certificate Files

Converting between SSL certificate formats means moving private keys around, so a few habits are worth building.

• Keep private keys off shared drives and out of email and chat.
• Use password-protected PFX files whenever a key has to travel between machines.
• Set strict file permissions on .key files, for example readable only by the web server user.
• Delete temporary conversion files once the certificate is installed.
• Track expiry dates. Formats do not matter if the certificate has expired.
• Keep a clean archive: certificate, chain, key (encrypted) and the CSR, labeled with the domain and expiry date.

If you want to understand the container behind PFX in more depth, the PKCS #12 personal information exchange standard describes how it protects private keys and certificates using password-based privacy and integrity modes. You do not need to read it to use PFX files, but it explains why the password is so important.

Key Takeaways

• SSL certificate formats differ in encoding (Base64 text or binary) and in what they bundle (certificate, chain, private key).
• PEM is Base64 encoded text with BEGIN and END lines. DER is the same data in binary form.
• .crt and .cer are just extensions. They can be PEM or DER, so always open the file to check.
• PFX/P12 is the only common format that bundles the certificate, chain and private key in one password-protected file.
• P7B holds certificates and chains but never a private key.
• Apache, Nginx and most hosting panels want PEM. IIS and Azure want PFX. Java handles PKCS#12 well.
• OpenSSL can convert PEM to PFX, PFX to PEM, CRT to PEM and DER to PEM in one line each.
• Most errors come from renaming instead of converting, missing intermediates, wrong chain order or a lost private key.

Frequently Asked Questions

1. What are the most common SSL certificate formats?

The most common SSL certificate formats are PEM, DER, PKCS#12 (PFX or P12) and PKCS#7 (P7B). PEM is used by Apache, Nginx and most Linux systems. PFX is preferred by Windows, IIS and Azure. DER appears in Java and some embedded devices, and P7B is often used to deliver certificate chains.

2. What is the difference between PEM and CRT?

PEM is an encoding, while CRT is a file extension. A .crt file is usually a PEM encoded certificate, so in many cases they are the same thing with different names. If your .crt file opens as readable text with a BEGIN CERTIFICATE line, it is already PEM.

3. What is a CRT file used for?

A CRT file stores a public SSL/TLS certificate, either for your domain or for an intermediate certificate authority. Web servers use it, along with the private key, to prove the site’s identity to browsers. It does not contain the private key itself.

4. Can I just rename a .cer file to .pem?

Only if the .cer file is already Base64 encoded. Open it in a text editor first. If you see BEGIN CERTIFICATE, renaming works. If you see unreadable characters, the file is binary DER and must be converted with OpenSSL before it can be used as PEM.

5. How do I convert PEM to PFX?

Run openssl pkcs12 with the export option, passing your private key, your certificate and the CA bundle, then set an export password. The result is a single password-protected PFX file that IIS, Azure and other Windows-based systems can import directly.

6. How do I convert PFX to PEM?

Use openssl pkcs12 with the input PFX file and an output PEM file. You can extract everything at once, or extract the certificate and private key separately with the nokeys and nocerts options. You will need the PFX password to complete the conversion.

7. Does a PFX file contain the private key?

Yes. A PFX or P12 file normally contains the certificate, the private key and often the intermediate chain, all protected by a password. That is why it is the safest format for moving a certificate between servers, and why you should guard both the file and its password.

8. What does Base64 encoded mean for a certificate?

It means the binary certificate data has been converted into plain ASCII characters so it can be stored and copied as text. Base64 encoded certificates are wrapped in BEGIN and END lines. Binary encoded certificates, known as DER, store the same information as raw bytes.

9. Why does my server say it cannot load the certificate?

The most common causes are a binary file being read as PEM, a damaged copy and paste with missing lines or extra spaces, the wrong file order in a chain, or a private key that does not match the certificate. Check the encoding first, then confirm the key and certificate match.

10. Is it safe to use an online SSL certificate converter?

It is generally safe for public certificates and chains. For private keys, choose a converter that processes files in your browser rather than uploading them, or use OpenSSL on a computer you control. Follow your organization’s security policy for production keys.

Conclusion

Once you separate encoding from file extension, SSL certificate formats stop being mysterious. PEM and DER are two ways of writing the same certificate, PFX bundles the key and chain behind a password, and P7B carries the chain on its own. Match the format to your server, check the file before you convert, and keep your private key safe at every step.

When you need a fast conversion without opening a terminal, try the free SSL certificate converter on X2X Converter. It converts between PEM, CER and PFX right in your browser, so you can get your certificate installed and move on with your day.