DER to PEM Converter
This DER to PEM converter Base64-encodes a raw binary DER certificate and wraps it in standard PEM headers. DER is the raw binary ASN.1 encoding of a certificate; PEM is that same data Base64-encoded and wrapped between BEGIN/END lines so it can be copied, pasted and emailed as text. The conversion happens entirely in your browser and works with both RSA and ECDSA certificates.
Processed entirely in your browser
Your files never leave your browser. The page sends only a usage counter signal containing the processing time — never any file content.
Verify this yourself
You don't have to take our word for it — check it yourself in 3 steps:
- Open your browser DevTools and select the Network tab
- Leave the filter on All — do not filter by Fetch/XHR
- Run the conversion and look at the request list
The usage counter is sent with sendBeacon, so it appears under ping (Other) and NOT under Fetch/XHR — that is why you should not filter. You will see a request to /track carrying the processing time. No request carries your file content or passphrase.
A binary DER file, usually with a .der or .cer extension — not text, no -----BEGIN----- line
Equivalent openssl command
If you would rather run it on your own machine, this command produces the equivalent result.
openssl x509 -in certificate.der -inform der -outform pem -out certificate.pemHow It Works
This tool Base64-encodes a binary DER certificate into PEM text entirely inside your browser — nothing you upload leaves your device. Upload your .der (or .cer) certificate file; the tool reads the raw bytes, Base64-encodes them with standard 64-character line wrapping, and wraps the result between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. The result downloads as certificate.pem.
This direction never touches a private key — there is no key field on this page — and never loads the node-forge library the PFX tools on this site depend on: encoding DER as PEM is plain Base64 encoding, not certificate parsing. That also means there is no RSA/ECDSA restriction here: certificates using either algorithm encode identically, since the tool never inspects the key material or certificate fields inside.
Because no forge module loads for this direction, the page is lighter and the conversion is effectively instant.
Common Use Cases
- Apache/Nginx Configuration: Most Linux web servers expect Base64 PEM text, not binary DER — convert a DER certificate exported from Windows or Java before uploading it to a Linux server
- Copy, Paste and Email: PEM's Base64 text format can safely go into a config file, ticket or email; binary DER cannot
- Version Control and Config Management: Store certificates as PEM text in Git, Ansible or Puppet — binary DER is awkward to diff and review
- Round-Tripping: Get a clean PEM file ready as input to BKNS's other PEM-based tools, like PEM to CRT
- ECDSA Certificates: Convert modern ECDSA DER certificates to PEM — this direction passes them through unchanged, algorithm-agnostic
Protect your website with BKNS SSL — from 199,000đ/year, free installation
Technical Background
DER and PEM are two different encoding layers of the same underlying X.509 certificate structure — unlike CRT and PEM, which are byte-identical under different file extensions. DER (Distinguished Encoding Rules) is the certificate's raw binary ASN.1 encoding, as issued by many Windows, Java and embedded tools. PEM takes that same binary data, Base64-encodes it, and wraps it between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines with 64-character line breaks, producing a plain-text file safe to copy, paste and version-control.
Converting DER to PEM is Base64 encoding, not certificate re-encoding: the tool encodes the exact input bytes and adds the standard header/footer and line wrapping. No private key, passphrase, or certificate semantics (subject, SANs, key algorithm) are read or altered — the operation is entirely at the envelope/encoding level, which is also why it works identically for RSA and ECDSA certificates and needs no cryptography library.
A DER file holds exactly one ASN.1-encoded certificate, so the PEM output from this tool always contains a single CERTIFICATE block — DER has no concept of the multi-certificate bundling PEM text allows.
If you need the equivalent command-line step, openssl x509 -in certificate.der -inform der -out certificate.pem -outform pem does the same conversion.