What is a PEM to CRT converter?

PEM and CRT are the same underlying certificate format — Base64-encoded X.509 wrapped between BEGIN/END lines — just different file extension conventions. This tool validates your PEM certificate and re-wraps it as a standalone .crt file with standard line formatting.

How do I use this PEM to CRT converter?

Paste or upload your PEM certificate fileClick convertDownload certificate.crtThere is no passphrase and no private key involved in this direction.

Is my certificate safe with this tool?

Yes — and you can verify it instead of taking our word for it. The conversion runs entirely in your browser and never touches a private key (there is no key field on this page). To check: open DevTools, select the Network tab, leave the filter on All and run a conversion. You will see a request to /track — a usage counter whose payload is only the processing time (execution_ms). It is sent with sendBeacon, so it appears under ping/Other; filtering by Fetch/XHR shows nothing. No request carries your certificate content.

What is the actual difference between PEM and CRT?

In practice, none at the byte level for a certificate — both are Base64-encoded X.509 wrapped between BEGIN/END lines. .pem is used more generically (also for keys and CSRs), while .crt/.cer is conventionally reserved for certificates, and some Windows tooling and control panels specifically expect the .crt extension. This tool exists for that practical reason, not because the content itself changes.

Yes, this PEM to CRT converter is completely free to use at tools.bkns.vn. No registration, subscription, or payment required.

Does this tool support ECDSA certificates?

Yes, fully and identically to RSA. This direction never inspects the key algorithm at all — it only validates and re-wraps the PEM envelope — so there is no RSA/ECDSA distinction here, unlike BKNS's PFX-building tools, which are RSA-only today.

PEM to CRT Converter

This PEM to CRT converter re-wraps a PEM certificate as a .crt file. PEM and CRT are the same underlying format — Base64-encoded X.509 wrapped between BEGIN/END lines — so this tool mainly validates and normalizes the file and renames it to the extension your server or tooling expects. The conversion happens entirely in your browser and works with both RSA and ECDSA certificates.

Processed entirely in your browser

Your files never leave your browser. The page sends only a usage counter signal containing the processing time — never any file content.

Verify this yourself

You don't have to take our word for it — check it yourself in 3 steps:

Open your browser DevTools and select the Network tab
Leave the filter on All — do not filter by Fetch/XHR
Run the conversion and look at the request list

The usage counter is sent with sendBeacon, so it appears under ping (Other) and NOT under Fetch/XHR — that is why you should not filter. You will see a request to /track carrying the processing time. No request carries your file content or passphrase.

Certificate (PEM/CRT)

or paste the content

The block starting with -----BEGIN CERTIFICATE-----

Equivalent openssl command

If you would rather run it on your own machine, this command produces the equivalent result.

openssl x509 -in certificate.pem -out certificate.crt -outform pem

How It Works

This tool re-wraps a PEM certificate as a .crt file entirely inside your browser — nothing you paste or upload leaves your device. Paste or upload your PEM certificate; the tool parses every CERTIFICATE block it finds (a bundle with more than one certificate is preserved in full, not trimmed to the first one), re-encodes each with standard 64-character line wrapping, and returns the result as certificate.crt.

This direction never touches a private key — there is no key field on this page at all — and never loads the node-forge library the PFX tools on this site depend on: PEM and CRT are the same PEM-armored byte format, just different file extensions by convention, so no cryptographic library is needed to move between them. That also means there is no RSA/ECDSA restriction here: certificates using either algorithm pass through identically, since the tool never inspects the key material inside the certificate.

Because no forge module loads for this direction, the page is lighter and the conversion is effectively instant.

Common Use Cases

Server Expects .crt: Some web servers and control panels look specifically for a .crt extension, even though the underlying content is identical to PEM
Normalizing a Certificate: Re-wrap a certificate copied from an email, ticket or config file with correct line breaks and formatting before uploading it somewhere strict about format
Preparing for CRT-to-PFX: Get a clean, standalone .crt file ready as the input to BKNS's CRT to PFX tool
Documentation and Tickets: Produce a properly formatted certificate file to attach when opening a support ticket with a CA or hosting provider
ECDSA Certificates: Convert modern ECDSA certificates that some legacy PEM-oriented tooling mislabels — this direction passes them through unchanged, algorithm-agnostic

🔒Need an SSL certificate?

Protect your website with BKNS SSL — from 199,000đ/year, free installation

Buy SSL

Technical Background

PEM and CRT are not actually two different encodings — they are the same container format under two different file extension conventions. Both are Base64-encoded DER (the binary ASN.1 encoding of an X.509 certificate), wrapped between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines with 64-character line breaks. .pem is the more format-agnostic extension (PEM armoring is also used for keys, CSRs and other object types), while .crt and .cer are conventionally used for certificates specifically — Windows and some CA tooling favor .crt/.cer even though the file content parses identically either way.

Because the byte format does not change, this conversion is validation and normalization rather than re-encoding: the tool confirms the input parses as valid PEM CERTIFICATE blocks, then re-serializes it with standard line wrapping. No private key, passphrase, or certificate semantics (subject, SANs, key algorithm) are read or altered — the operation is entirely at the envelope level, which is also why it works identically for RSA and ECDSA certificates and needs no cryptography library.

If you need the equivalent command-line step, openssl x509 -in certificate.pem -out certificate.crt -outform pem does the same normalization.