Certificates & Formats

What Is Certificate Formats (PEM, DER, P7B, PFX)?

Certificate formats are the different file encodings an X.509 certificate travels in: PEM (base64 text with BEGIN/END headers), DER (raw binary), PKCS#7/P7B (a certificate bundle, often with the chain), and PKCS#12/PFX (certificate plus private key, password-protected). The certificate inside is identical — the wrapper determines which software can read it.

Recognizing the format

PEM files start with "-----BEGIN CERTIFICATE-----" and are readable text — extensions .pem, .crt, .cer, .key. DER is the same content in binary — opening it in a text editor shows gibberish, usually .der or .cer. P7B holds one or more certificates (never the private key), usually .p7b or .p7c. PFX/P12 is the only common format that also contains the private key, protected by a password — .pfx or .p12.

The extension is a hint, not a guarantee: .cer can be PEM or DER. If a tool refuses a file, checking the actual encoding is the first step.

Which format each platform expects

Apache, Nginx and most Linux tooling want PEM, with certificate and key in separate files. Windows IIS imports PFX (certificate + key together) and CA-provided chains as P7B. Java keystores historically want DER or their own JKS/PKCS#12 containers. Load balancers and appliances vary — which is why format conversion is a daily task in certificate operations.

Converting between formats

Every pairwise conversion is a one-liner with OpenSSL or one upload in an online converter. The only conversions that need extra input are into PFX (requires the private key and a password) and out of PFX (requires the password). Detailed per-pair instructions — PEM→PFX, PFX→PEM, DER→PEM, P7B→PEM and back — are on our converter page.

Try it yourself — free tools

Certificate Converter — convert between PEM, DER, P7B and PFX with per-pair instructions
Certificate Checker — decode a certificate in any format and inspect its contents

How MI Support IT can help

PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.