Converting SSL certificates between different formats is a common need when working with various servers, applications, and platforms. In this article, we will explain how to convert your certificate file to the most used file extensions.
Please check the image below for a basic understanding of what type of SSL format is required for different servers.
In the certificate ZIP folder, you will find the .crt and .txt file formats, which can be converted as needed to match your server requirements.
The comprehensive guides below explain the most common SSL certificate formats and how to convert them using various methods.
1. Convert .txt file to .pem /.der /.cer /.crt
Note: This method can be used to convert files from .txt to .pem or .txt to .der, but it cannot be used to generate .PFX or .P12 formats.
We provide the certificate Zip file including CER – CRT Files and Plain Text Files folders. Simply open the Plain Text file folder and open the certificate in Notepad, then click on File >> Save As.
Save As File name: Please keep the domain name or order number and change the extension after to .pem / .cer / .der >> Save as type : All files >> Save.
The conversion from .txt to .pem format has been completed.
The same method can be applied to convert bundle files from .txt into .der, .cer, or .crt formats.
2. Convert Certificate file in different formats using OpenSSL
Download the certificate files from your order details page and extract the Zip file to any specific folder, for example: D:\123456789\CER - CRT Files, and execute the OpenSSL command, ensuring the correct file path is specified.
(The following commands are executed within the specific directory path D:\123456789\CER - CRT Files for clarity and ease of understanding.)
openssl x509 -in "D:\123456789\CER - CRT Files\star_yourdomain_com.crt” -outform der -out "D:\123456789\CER - CRT Files\yourdomain.der"
The above command will convert .crt files to .der and will save to the folder with the name as mentioned in the command.
Note: The command parameter -in specifies the exact certificate name and path as they exist, while the -out parameter allows you to define the desired output path and certificate name.
Ensure that the file name and file path in the command are updated to match your system’s directory structure.
Please check the below OpenSSL command for other file format conversation.
Convert .der to .pem
OpenSSL x509 -in "D:\123456789\CER - CRT Files\yourdomain.der” -outform der -out "D:\123456789\CER - CRT Files\yourdomain.pem"
A .p7b file (also known as PKCS#7) is a certificate file format typically used for storing certificates and certificate chains, but it doesn't contain the private key.
OpenSSL crl2pkcs7 -nocrl -certfile "D:\123456789\CER - CRT Files\star_yourdomain_com.crt” -certfile "D:\123456789\CER - CRT Files\My_CA_Bundle.ca-bundle” -out "D:\123456789\CER - CRT Files\yourdomain.p7b”
Convert .P7b to .cer
OpenSSL pkcs7 -print_certs -in "D:\123456789\CER - CRT Files\yourdomain.p7b” -out "D:\123456789\CER - CRT Files\star_yourdomain_com.cer”
3. Convert Certificate files in PFX/PKCS12 format
The most important file type is the .PFX as it is required to complete the installation on different servers.
.PFX (or .p12) file is used to bundle a certificate and its private key into a single encrypted file. If you want to convert a PEM certificate and private key into a .pfx file, you must have both the certificate files and the private key .
Please note that the private key is generated with the CSR (Certificate Signing Request) and is stored on the server where the CSR was generated. Before converting to .pfx you may need to check if your .key file is available on your server. If the key is not saved (or it is not exportable), then you need to generate a new CSR and private key, then reissue the order to get a new certificate file with a matching key.
For guidance on generating a new CSR and private key via OpenSSL, please refer to the article How to Generate a CSR for Apache Using OpenSSL.
If the certificate files and Private key are stored in specific folder like D:/, then run the below command to generate PFX/PKCS12 file
OpenSSL pkcs12 -export -out "D:\123456789\CER - CRT Files\yourdomain.pfx" -inkey "D:\123456789\CER - CRT Files\yourdomain.key" -in "D:\123456789\CER - CRT Files\yourdomain.crt" -certfile "D:\123456789\CER - CRT Files\My_CA_Bundle.ca-bundle"
Add the command -certfile My_CA_Bundle.ca-bundle if want to add certificate chains in the .PFX
Hurray! Your PFX file has been generated in the designated folder.
If you have a .P7b file and want to convert to PFX, then use the command below.
First convert the P7B file to .cer
OpenSSL pkcs7 -print_certs -in "D:\123456789\CER - CRT Files\yourdomain.p7b” -out "D:\123456789\CER - CRT Files\star_yourdomain_com.cer”
Second convert to PFX with private key.
openssl pkcs12 -export -in "D:\123456789\CER - CRT Files\star_yourdomain_com.cer” -inkey "D:\123456789\CER - CRT Files /yourdomain.key” -out “D:\certificate.pfx -certfile CACert.cer
Upon execution, the PFX file will be created and saved in the designated folder.
