What is a P7B to PEM converter?

A P7B to PEM converter unpacks a PKCS#7 (.p7b) certificate bundle and extracts every certificate it contains — the leaf plus any intermediates — into a single PEM file. P7B never contains a private key; PEM is what Apache, Nginx and most Linux tooling expect.

How do I use this P7B to PEM converter?

Paste or upload your P7B bundle (.p7b or .p7c extension)Click convertDownload certificate.pem — every certificate found, in the original orderThere is no passphrase and no private key involved in this direction.

Is my certificate bundle safe with this tool?

Yes — and you can verify it instead of taking our word for it. The conversion runs entirely in your browser and never touches a private key (there is no key field on this page). To check: open DevTools, select the Network tab, leave the filter on All and run a conversion. You will see a request to /track — a usage counter whose payload is only the processing time (execution_ms). It is sent with sendBeacon, so it appears under ping/Other; filtering by Fetch/XHR shows nothing. No request carries your certificate content.

Will this converter give me the full certificate chain?

Yes. It extracts every certificate stored in the P7B — the leaf plus any intermediates — in the exact order the bundle stored them, into one certificate.pem file. Nothing is trimmed to a single certificate the way PFX to CRT does; if you specifically need just the leaf, decode the resulting PEM with an SSL decoder tool to identify it.

Yes, this P7B to PEM converter is completely free to use at tools.bkns.vn. No registration, subscription, or payment required.

Does this tool support ECDSA certificates?

Yes. This tool deliberately avoids the full X.509 semantic parser that some PKCS#7 libraries use (which fails on ECDSA certificates) and instead re-serializes each certificate's raw ASN.1 structure directly. RSA and ECDSA certificates inside a P7B extract identically.

P7B to PEM Converter for Apache and Nginx

This P7B to PEM converter unpacks a PKCS#7 (.p7b) certificate bundle and extracts every certificate it contains — leaf plus intermediates — into a single PEM file, ready for Apache, Nginx and most Linux tooling. The conversion happens entirely in your browser, so your certificate chain never leaves your device. Works with both RSA and ECDSA certificates.

Processed entirely in your browser

Your files never leave your browser. The page sends only a usage counter signal containing the processing time — never any file content.

Verify this yourself

You don't have to take our word for it — check it yourself in 3 steps:

Open your browser DevTools and select the Network tab
Leave the filter on All — do not filter by Fetch/XHR
Run the conversion and look at the request list

The usage counter is sent with sendBeacon, so it appears under ping (Other) and NOT under Fetch/XHR — that is why you should not filter. You will see a request to /track carrying the processing time. No request carries your file content or passphrase.

Certificate bundle P7B (PKCS#7)

A PKCS#7 file containing one or more certificates, usually with a .p7b or .p7c extension — typically emailed by your CA, not a plain PEM block

Equivalent openssl command

If you would rather run it on your own machine, this command produces the equivalent result.

openssl pkcs7 -print_certs -in certificate.p7b -out certificate.pem

How It Works

This tool unpacks a P7B certificate bundle entirely inside your browser — nothing you paste or upload leaves your device. Upload or paste your P7B file; the tool locates the certificates field inside its PKCS#7 SignedData structure and extracts every certificate stored there — the leaf plus any intermediates — in the exact order the bundle stored them. Nothing is reordered or dropped, and nothing is guessed about which certificate is the leaf, unlike PFX to CRT: this direction simply returns everything the P7B contains as a single certificate.pem file.

There is no private key field on this page — a P7B never contains one. This tool also does not use the full X.509 semantic parser the PFX-building tools rely on; it re-serializes each certificate's raw ASN.1 structure directly, without fully interpreting it. That is a deliberate choice: it is what lets this direction work with ECDSA certificates that a full X.509 parser would otherwise reject.

Because the P7B envelope still requires ASN.1 structure parsing, this tool loads a small library chunk to open it — lighter than the full node-forge PKCS#12 module the PFX tools load, but present, unlike the pure pem-to-crt/crt-to-pem envelope tools which load nothing at all.

Common Use Cases

Migrating from Windows/IIS: Many internal CAs (Microsoft ADCS) and some public CAs deliver certificates as P7B — this tool unpacks it into the PEM files Apache and Nginx expect
Recovering the Full Chain: Extract the leaf plus every intermediate certificate bundled inside a P7B for use in an Nginx ssl_certificate chain file
Certificate Inspection: Pull the individual certificates out of a P7B to check them with a decoder tool
Preparing for PEM-to-PFX: Get a chain file ready to combine with a private key using BKNS's PEM to PFX tool
ECDSA Certificate Chains: Extract a chain that includes ECDSA certificates — this direction handles them without the full-parser failures some legacy P7B tooling has

🔒Need an SSL certificate?

Protect your website with BKNS SSL — from 199,000đ/year, free installation

Buy SSL

Technical Background

A P7B is a PKCS#7 ContentInfo wrapping a SignedData structure — the same container format used for signed messages, repurposed to carry certificates. Its certificates [0] IMPLICIT SET OF Certificate field holds one or more X.509 certificates with no private key at all; this is the format many Microsoft CAs (ADCS) and some public CAs export by default. PEM is a plain text envelope for the same certificate data — Base64-encoded DER wrapped between -----BEGIN CERTIFICATE-----/-----END CERTIFICATE----- lines — what Apache, Nginx and most Linux tooling expect, usually as one certificate per file or concatenated into a chain file.

This tool walks the SignedData structure by ASN.1 tag (looking for the context-specific [0] field, not a fixed array index, since an optional crls [1] field can appear between other fields depending on how the P7B was generated) and re-serializes each certificate node it finds directly with asn1.toDer(), without decoding it into a full certificate object first. That distinction matters: the general-purpose PKCS#7 module most crypto libraries ship, including the one this site's PFX tools use, forces full X.509 semantic parsing on every certificate and throws immediately on an unfamiliar key algorithm — which includes ECDSA. Working at the raw ASN.1 level instead means this tool extracts RSA and ECDSA certificates identically, without needing to understand what is inside them.

If you need the equivalent command-line step, openssl pkcs7 -print_certs -in certificate.p7b -out certificate.pem does the same extraction.