What is a CRT to PEM converter?

CRT and PEM are the same underlying certificate format — Base64-encoded X.509 wrapped between BEGIN/END lines — just different file extension conventions. This tool validates your CRT certificate and re-wraps it as a standalone .pem file with standard line formatting, the extension Apache and Nginx documentation typically uses.

How do I use this CRT to PEM converter?

Paste or upload your CRT certificate file (.crt or .cer extension)Click convertDownload certificate.pemThere is no passphrase and no private key involved in this direction.

Is my certificate safe with this tool?

Yes — and you can verify it instead of taking our word for it. The conversion runs entirely in your browser and never touches a private key (there is no key field on this page). To check: open DevTools, select the Network tab, leave the filter on All and run a conversion. You will see a request to /track — a usage counter whose payload is only the processing time (execution_ms). It is sent with sendBeacon, so it appears under ping/Other; filtering by Fetch/XHR shows nothing. No request carries your certificate content.

What is the actual difference between CRT and PEM?

In practice, none at the byte level for a certificate — both are Base64-encoded X.509 wrapped between BEGIN/END lines. .crt/.cer is conventionally used on Windows and by some CAs, while .pem is the extension most Apache and Nginx documentation and config examples use. This tool exists for that practical reason, not because the content itself changes.

Yes, this CRT to PEM converter is completely free to use at tools.bkns.vn. No registration, subscription, or payment required.

Does this tool support ECDSA certificates?

Yes, fully and identically to RSA. This direction never inspects the key algorithm at all — it only validates and re-wraps the PEM envelope — so there is no RSA/ECDSA distinction here, unlike BKNS's PFX-building tools, which are RSA-only today.

CRT to PEM Converter for Apache and Nginx

This CRT to PEM converter re-wraps a CRT certificate as a .pem file. CRT and PEM are the same underlying format — Base64-encoded X.509 wrapped between BEGIN/END lines — so this tool mainly validates and normalizes the file for tooling that specifically expects a `.pem` extension, such as most Apache and Nginx setups. The conversion happens entirely in your browser and works with both RSA and ECDSA certificates.

Processed entirely in your browser

Your files never leave your browser. The page sends only a usage counter signal containing the processing time — never any file content.

Verify this yourself

You don't have to take our word for it — check it yourself in 3 steps:

Open your browser DevTools and select the Network tab
Leave the filter on All — do not filter by Fetch/XHR
Run the conversion and look at the request list

The usage counter is sent with sendBeacon, so it appears under ping (Other) and NOT under Fetch/XHR — that is why you should not filter. You will see a request to /track carrying the processing time. No request carries your file content or passphrase.

Certificate (PEM/CRT)

or paste the content

The block starting with -----BEGIN CERTIFICATE-----

Equivalent openssl command

If you would rather run it on your own machine, this command produces the equivalent result.

openssl x509 -in certificate.crt -out certificate.pem -outform pem

How It Works

This tool re-wraps a CRT certificate as a .pem file entirely inside your browser — nothing you paste or upload leaves your device. Paste or upload your CRT certificate; the tool parses every CERTIFICATE block it finds (a bundle with more than one certificate is preserved in full, not trimmed to the first one), re-encodes each with standard 64-character line wrapping, and returns the result as certificate.pem.

This direction never touches a private key — there is no key field on this page at all — and never loads the node-forge library the PFX tools on this site depend on: CRT and PEM are the same PEM-armored byte format, just different file extensions by convention, so no cryptographic library is needed to move between them. That also means there is no RSA/ECDSA restriction here: certificates using either algorithm pass through identically, since the tool never inspects the key material inside the certificate.

Because no forge module loads for this direction, the page is lighter and the conversion is effectively instant.

Common Use Cases

Migrating from IIS/Windows: A certificate delivered as .crt is exactly what most Apache and Nginx configs need — this tool gives you the .pem extension those configs expect
Normalizing a Certificate: Re-wrap a .crt copied from a control panel or email with correct line breaks before uploading it somewhere strict about format
Building a Full Chain File: Convert a CRT into PEM, then concatenate it with intermediates for an Nginx ssl_certificate bundle
Preparing for PEM-to-PFX: Get a clean .pem file ready as the input to BKNS's PEM to PFX tool
ECDSA Certificates: Convert modern ECDSA certificates that some legacy tooling mislabels — this direction passes them through unchanged, algorithm-agnostic

🔒Need an SSL certificate?

Protect your website with BKNS SSL — from 199,000đ/year, free installation

Buy SSL

Technical Background

PEM and CRT are not actually two different encodings — they are the same container format under two different file extension conventions. Both are Base64-encoded DER (the binary ASN.1 encoding of an X.509 certificate), wrapped between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines with 64-character line breaks. .crt/.cer is what Windows and some CA tooling favor, while .pem is the extension most Apache and Nginx documentation and config examples use, even though the file content parses identically either way.

Because the byte format does not change, this conversion is validation and normalization rather than re-encoding: the tool confirms the input parses as valid PEM CERTIFICATE blocks, then re-serializes it with standard line wrapping. No private key, passphrase, or certificate semantics (subject, SANs, key algorithm) are read or altered — the operation is entirely at the envelope level, which is also why it works identically for RSA and ECDSA certificates and needs no cryptography library.

If you need the equivalent command-line step, openssl x509 -in certificate.crt -out certificate.pem -outform pem does the same normalization.