WebChecks

Certificate Format Converter

Pick the formats you have and need, upload or paste your files, and we'll handle the conversion — your private key is never transmitted or uploaded.

New to certificates? Quick primer on how this works

In general, getting a certificate installed looks like this:

  1. Generate a private/public key pair. The private key must stay secret — never send it anywhere except the system that will use it.
  2. Create a CSR (Certificate Signing Request) from that key pair — it bundles your public key with identifying info (domain, organization) and gets sent to a Certificate Authority (CA).
  3. The CA verifies you and issues a signed certificate back, usually along with one or more intermediate certificates that chain it up to a trusted root.
  4. Install the certificate, its intermediate chain, and your original private key together on the target system — this is where file format matters, and where this tool helps.

This tool picks up at step 4: it converts between file formats. It doesn't generate keys or CSRs (steps 1–2) or issue certificates (step 3).

File types, in plain language:

Private key .key
The secret half of a key pair. Whoever holds it can prove they're really you. Never share it.
CSR .csr
Certificate Signing Request — your public key plus identity info, sent to a CA to get a certificate issued. You generate a new one from your key when needed; this tool doesn't handle these.
Certificate .crt / .cer / .pem
The public, signed proof of identity the CA gives back. Safe to share. The .crt/.cer extension alone doesn't say whether it's PEM or DER underneath (see below) — this tool figures that out for you.
PEM
Plain ASCII text, starting with -----BEGIN CERTIFICATE-----. Easy to open, paste, or email. Certificates and keys can both be PEM-encoded.
DER
The same data as PEM, but as raw binary instead of text. Some Windows-oriented tools expect this instead.
PKCS#7 .p7b / .p7c
A bundle of certificates only — never a private key. Usually your certificate plus its intermediate chain, packaged together so you don't juggle separate files.
PKCS#12 .pfx / .p12
One password-protected file containing your certificate, private key, and chain all together. What Windows, IIS, browsers, and most "double-click to import" flows expect.
JKS
Java's own keystore format — not PEM/DER-based, and not supported by this tool yet. Java's own keytool command converts into and out of it.

From

To

Possible to convert?