Certificate Management Service:What are the common SSL certificate formats?

Identify PEM files by content

Open the file in a text editor. A PEM file contains an ASCII block with BEGIN and END markers. The marker identifies what the file contains:

-----BEGIN CERTIFICATE-----
MIIE5zCCA8+gAwIBAgIQN+whYc2BgzAogau0dc3PtzANBgkqh......
-----END CERTIFICATE-----

Common markers:

Identify formats using OpenSSL

For binary files or when you need detailed information, use OpenSSL to inspect the file.

PEM certificate

# Displays subject, issuer, validity period, and other details
openssl x509 -in certificate.crt -noout -text

If the command succeeds, the file is a PEM-encoded certificate.

PEM private key

# Displays key type and length
openssl pkey -in private.key -noout -text

PFX/P12 certificate store

# Lists all entries in the PKCS#12 file; prompts for the import password
openssl pkcs12 -in keystore.pfx -info -noout

DER certificate

# The -inform der flag tells OpenSSL to read binary DER input
openssl x509 -in certificate.der -inform der -noout -text

Convert PEM to PFX (for IIS and Tomcat)

This command combines a certificate file, a private key file, and an optional chain file into a single password-protected PFX file.

# Server certificate and private key only
openssl pkcs12 -export \
  -out server.pfx \        # Output PFX file
  -inkey private.key \     # Private key file
  -in server.crt           # Server certificate

# With a complete certificate chain
openssl pkcs12 -export \
  -out server.pfx \
  -inkey private.key \
  -in server.crt \
  -certfile chain.crt      # Intermediate certificate chain

Split PFX to PEM (for Nginx and Apache)

These commands extract the certificate and private key from a PFX file into separate PEM files.

# Step 1: Extract the private key (password-protected)
openssl pkcs12 -in server.pfx -nocerts -out server.encrypted.key

# Step 2: Extract the server certificate only (leaf certificate, no CA chain)
openssl pkcs12 -in server.pfx -clcerts -nokeys -out server.crt

# Step 3: Extract the intermediate CA certificates
# Note: The root CA certificate is not required for deployment
openssl pkcs12 -in server.pfx -cacerts -nokeys -out chain.crt

# Step 4 (optional): Remove the password from the private key
# Required for servers that start non-interactively (Nginx, Apache)
openssl pkey -in server.encrypted.key -out private.key

# Step 5 (optional): Concatenate into a single chain file
# Skip this step if chain.crt does not exist (no intermediate certs in the PFX)
# Order matters: server certificate first, then intermediate certificates
cat server.crt chain.crt > fullchain.crt

Nginx configuration after conversion:

ssl_certificate     /path/to/fullchain.crt;
ssl_certificate_key /path/to/private.key;

Apache configuration after conversion:

For Apache 2.4.8 and later:

SSLCertificateFile    /path/to/fullchain.crt
SSLCertificateKeyFile /path/to/private.key

For Apache earlier than 2.4.8, configure the intermediate chain separately:

SSLCertificateFile      /path/to/server.crt
SSLCertificateKeyFile   /path/to/private.key
SSLCertificateChainFile /path/to/chain.crt

Convert between DER and PEM

DER and PEM represent the same data in different encodings — binary ASN.1 versus Base64-encoded ASN.1 with markers. Convert between them when a server or tool requires a specific encoding.

# DER to PEM
openssl x509 -inform der -in certificate.cer -out certificate.pem

# PEM to DER
openssl x509 -inform pem -in certificate.pem -outform der -out certificate.der

Convert JKS to PKCS#12 (recommended migration path)

Use Java's keytool utility to convert a legacy Java Keystore (JKS) to PKCS#12.

keytool -importkeystore \
  -srckeystore keystore.jks \    # Source JKS file
  -srcstoretype JKS \
  -destkeystore keystore.p12 \   # Output PKCS#12 file
  -deststoretype PKCS12

This migrates all entries from keystore.jks to keystore.p12. To migrate only a specific entry, add -srcalias <alias> and -destalias <alias>. The command prompts for both the source (JKS) password and the destination (PKCS#12) password.