Skip to main content
Operations

Convert SSL Certificates Between PEM, PFX, JKS, and DER

Convert SSL certificate and keystore formats with OpenSSL and keytool, with commands for common deployment scenarios.

CertOne4 min read

Servers and applications accept different certificate and keystore formats, including PEM, PFX, JKS, and DER. This guide explains common conversion commands and when to use each format.

1. Common Certificate Formats​

1. PEM​

Features:

  • Base64-encoded text with header and footer lines
  • A widely supported format
  • Common extensions include .pem, .crt, .cer, and .key.

Typical uses:

  • Web servers such as Nginx and Apache
  • Linux systems
  • Most Unix-like systems

2. PFX/P12​

Features:

  • A binary format
  • Can contain certificates and private keys
  • Usually protected with a password
  • File extensions: .pfx and .p12

Typical uses:

  • Windows IIS
  • Windows systems
  • Transferring a certificate together with its private key

3. JKS​

Features:

  • The Java KeyStore format
  • A binary format
  • Can hold multiple certificate and key entries
  • Common extensions: .jks and .keystore

Typical uses:

  • Java applications
  • Tomcat servers
  • Applications that require a Java keystore

4. DER​

Features:

  • A binary format
  • Binary encoding using ASN.1 Distinguished Encoding Rules
  • Common extensions: .der and .cer

Typical uses:

  • Some Windows applications
  • Applications that require binary-encoded certificates

2. Convert from PEM​

1. PEM to PFX​

# Convert with OpenSSL
openssl pkcs12 -export \
  -out certificate.pfx \
  -inkey private.key \
  -in certificate.crt \
  -certfile chain.crt \
  -passout pass:your_password

Parameters:

  • -out: Output file
  • -inkey: Private key file
  • -in: Certificate file
  • -certfile: Additional certificate chain file, if required
  • -passout: Output password

2. PEM to JKS​

# Convert to PKCS12 first, then to JKS
openssl pkcs12 -export \
  -out certificate.p12 \
  -inkey private.key \
  -in certificate.crt \
  -certfile chain.crt \
  -passout pass:your_password

# Convert to JKS with keytool
keytool -importkeystore \
  -srckeystore certificate.p12 \
  -srcstoretype PKCS12 \
  -srcstorepass your_password \
  -destkeystore certificate.jks \
  -deststoretype JKS \
  -deststorepass your_password

3. PEM to DER​

# Convert the certificate to DER
openssl x509 -in certificate.crt \
  -outform DER \
  -out certificate.der

# Convert the private key to DER
openssl rsa -in private.key \
  -outform DER \
  -out private.der

3. Convert from PFX​

1. PFX to PEM​

# Extract the certificate
openssl pkcs12 -in certificate.pfx \
  -clcerts -nokeys \
  -out certificate.crt \
  -passin pass:your_password

# Extract the private key
openssl pkcs12 -in certificate.pfx \
  -nocerts -nodes \
  -out private.key \
  -passin pass:your_password

# Extract CA certificates
openssl pkcs12 -in certificate.pfx \
  -cacerts -nokeys \
  -out chain.crt \
  -passin pass:your_password

2. PFX to JKS​

# Convert with keytool
keytool -importkeystore \
  -srckeystore certificate.pfx \
  -srcstoretype PKCS12 \
  -srcstorepass your_password \
  -destkeystore certificate.jks \
  -deststoretype JKS \
  -deststorepass your_password

4. Convert from JKS​

1. JKS to PEM​

# Convert to PKCS12 first
keytool -importkeystore \
  -srckeystore certificate.jks \
  -srcstoretype JKS \
  -srcstorepass your_password \
  -destkeystore certificate.p12 \
  -deststoretype PKCS12 \
  -deststorepass your_password

# Then convert to PEM
openssl pkcs12 -in certificate.p12 \
  -nodes \
  -out certificate.pem \
  -passin pass:your_password

2. JKS to PFX​

# Convert directly
keytool -importkeystore \
  -srckeystore certificate.jks \
  -srcstoretype JKS \
  -srcstorepass your_password \
  -destkeystore certificate.pfx \
  -deststoretype PKCS12 \
  -deststorepass your_password

5. Convert from DER​

1. DER to PEM​

# Convert the certificate to PEM
openssl x509 -inform DER \
  -in certificate.der \
  -out certificate.crt

# Convert the private key to PEM
openssl rsa -inform DER \
  -in private.der \
  -out private.key

2. PEM to DER​

# Convert the certificate to DER
openssl x509 -outform DER \
  -in certificate.crt \
  -out certificate.der

# Convert the private key to DER
openssl rsa -outform DER \
  -in private.key \
  -out private.der

6. Convert a Complete Certificate Chain​

1. Combine the Chain in PEM Format​

# Combine the server certificate and intermediate certificates
cat certificate.crt chain.crt > fullchain.pem

2. Extract the Complete Chain from PFX​

# Extract the complete certificate chain
openssl pkcs12 -in certificate.pfx \
  -nodes \
  -out fullchain.pem \
  -passin pass:your_password

7. Common Deployment Scenarios​

1. Nginx/Apache​

Required format: PEM

Conversion steps:

  • Convert an existing PFX file to PEM.
  • Convert an existing JKS file to PFX, then to PEM.

2. Windows IIS​

Required format: PFX

Conversion steps:

  • Convert an existing PEM certificate and key to PFX.
  • Ensure that the PFX contains both the certificate and its private key.

3. Java Applications​

Required format: JKS for applications configured to use JKS

Conversion steps:

  • Convert PEM to PFX, then to JKS.
  • Convert an existing PFX file directly to JKS.

4. Mobile Applications​

Required format: PEM or DER, depending on the API

Conversion steps:

  • Select the format required by the platform and API.
  • Check the certificate format accepted by the iOS API you use.
  • Check whether the Android API expects DER or PEM.

8. Online Conversion Tools​

1. SSL Shopper​

An online converter is available at https://www.sslshopper.com/ssl-converter.html.

2. Considerations​

  • Some online conversions require uploading a private key, which exposes sensitive key material.
  • Prefer local command-line tools for conversions involving private keys.
  • Keep private keys secure.

Best practices​

1. Security Practices​

  • ✅ Use strong passwords for encrypted output.
  • ✅ Remove temporary files after conversion.
  • ✅ Store private keys securely.
  • ✅ Perform conversions in a trusted environment.

2. Backups​

  • ✅ Back up the original files before conversion.
  • ✅ Store the converted files securely.
  • ✅ Record the conversion parameters.

3. Verify​

  • ✅ Validate the certificate after conversion.
  • ✅ Check that the certificate chain is complete.
  • ✅ Test the certificate in the target application.

10. Common Issues​

1. The Converted Certificate Is Invalid​

Possible causes:

  • Incomplete certificate chain
  • Mismatched private key
  • The output format is incorrect.

Resolution:

  • Check the certificate chain
  • Confirm that the certificate matches the private key
  • Verify the certificate format.

2. Password Issues​

Issue: The conversion requires a password.

Resolution:

  • Use -passin and -passout to specify input and output passwords.
  • Where appropriate, -nodes writes an unencrypted private key; protect the output file accordingly.

3. Certificate Chain Issues​

Issue: The converted file is missing intermediate certificates.

Resolution:

  • Use -certfile to include the certificate chain.
  • Alternatively, combine the chain files manually.

Conclusion​

Certificate format conversion is a routine part of certificate management. OpenSSL and keytool support conversions between commonly used certificate and keystore formats.

Key points:

  • ✅ PEM: Widely supported and suitable for many deployments.
  • ✅ PFX: Commonly used on Windows.
  • ✅ JKS: Used by Java applications configured for this keystore format.
  • ✅ Use OpenSSL and keytool for conversions.
  • ✅ Protect private keys throughout the process.

CertOne provides certificate files in PEM format for use with a wide range of servers and applications.