# Convert DER to PEM

To convert a DER certificate to PEM, run `openssl x509 -inform der -in certificate.der -out certificate.pem`. The `-inform der` flag is required because OpenSSL assumes PEM input by default and will fail with a "no start line" error without it. PEM output is the default, so no `-outform` is needed. For other object types use `openssl req` for a CSR, `openssl pkey` for a private key, and `openssl pkcs7` for a P7B bundle.

Source: https://certguru.io/convert/der-to-pem/
Last updated: 2026-08-19
Commands verified against OpenSSL 3.5.7.

---

## Certificates

*DER certificate to PEM*

```bash
openssl x509 -inform der -in certificate.der -out certificate.pem
```

| Placeholder | What to put there |
| --- | --- |
| `-inform der` | Required. Without it OpenSSL assumes PEM input and fails. |
| `certificate.der` | The binary input. Often named `.cer` or `.crt`. |
| `certificate.pem` | Base64 output with BEGIN/END lines. |

> **-inform is the flag people forget**
>
> Almost every "conversion does not work" report on DER input comes down to a missing
>   `-inform der`. OpenSSL does not sniff the input encoding for you.

## First, confirm what you actually have

Files arrive with unhelpful extensions. Check the first two bytes rather than the name:

*DER begins 0x30 0x82; PEM begins with a dash*

```bash
head -c 2 mystery.cer | xxd
```

Expected output:

```
00000000: 3082                                     0.
```

Or let `file` do it:

```bash
file mystery.cer
```

Expected output:

```
mystery.cer: Certificate, Version=3
```

If the file turns out to be PEM already, there is nothing to convert — see
[converting a .crt to PEM](/convert/crt-to-pem/) for the rename-only case.

## Other object types

| What the file holds | Command |
| --- | --- |
| Certificate | `openssl x509 -inform der -in in.der -out out.pem` |
| CSR | `openssl req -inform der -in in.der -out out.pem` |
| Private key | `openssl pkey -inform der -in in.der -out out.pem` |
| Public key | `openssl pkey -pubin -inform der -in in.der -pubout -out out.pem` |
| PKCS#7 bundle | `openssl pkcs7 -inform der -in in.p7b -print_certs -out out.pem` |
| CRL | `openssl crl -inform der -in in.crl -out out.pem` |

*DER private key to PEM*

```bash
openssl pkey -inform der -in private.der -out private.key
```

## The common real-world case: an intermediate from a CA

Certificate authorities publish intermediates in DER, linked from the Authority Information Access
extension of the certificate they signed. Fetching one and appending it to a chain is the usual
reason to run this conversion at all:

*Fetch the intermediate, convert it, build the chain*

```bash
curl -sO http://crt.example-ca.com/intermediate.der
openssl x509 -inform der -in intermediate.der -out intermediate.pem
cat certificate.crt intermediate.pem > fullchain.crt
```

That is the fix for [unable to get local issuer certificate](/errors/unable-to-get-local-issuer-certificate/).

## Verify the result

```bash
openssl x509 -in certificate.pem -noout -subject -issuer -enddate
```

Expected output:

```
subject=CN = example.com
issuer=C = US, O = Example CA, CN = Example Intermediate CA
notAfter=Nov 14 12:00:00 2026 GMT
```

If that prints the expected details, the conversion worked. If it errors, the input was not a
certificate — go back and check which object type you actually have.


## Frequently asked questions

### Why do I get "PEM routines::no start line"?

Because you omitted `-inform der`. OpenSSL defaulted to PEM, looked for a `-----BEGIN` line in a binary file, and did not find one. See that error in detail.

### My file is called .cer — is it DER or PEM?

The extension does not tell you. `.cer` is used for both. Check the first byte instead — `0x30` means DER, and a `-` character means PEM.

### Can I convert a DER file containing a whole chain?

Not directly, because DER has no delimiters and a concatenation cannot be split reliably. A binary file holding several certificates is almost certainly PKCS#7, so try `openssl pkcs7 -inform der -in bundle.p7b -print_certs` instead.

### Does this change the certificate's validity or fingerprint?

No. The encoding changes, the bytes being encoded do not. The signature stays valid and the SHA-256 fingerprint is identical before and after.


## References

- [openssl-x509(1)](https://docs.openssl.org/3.5/man1/openssl-x509/) — -inform der
- [RFC 7468: textual encodings of PKIX structures](https://www.rfc-editor.org/rfc/rfc7468) — defines the PEM armour and what may sit between the BEGIN and END lines

## Related pages

- https://certguru.io/convert/pem-to-der/
- https://certguru.io/convert/crt-to-pem/
- https://certguru.io/formats/der/
- https://certguru.io/formats/pem/
- https://certguru.io/errors/pem-routines-no-start-line/

--
CertGuru — https://certguru.io