CertGuru

Convert DER to PEM

To convert a DER certificate to PEM, run `openssl x509 -inform der -in certificate.der -out certificate.pem`. The `-inform der` flag is required because OpenSSL assumes PEM input by default and will fail with a "no start line" error without it. PEM output is the default, so no `-outform` is needed. For other object types use `openssl req` for a CSR, `openssl pkey` for a private key, and `openssl pkcs7` for a P7B bundle.

Updated August 19, 2026 Verified against OpenSSL 3.5.7

Certificates #

DER certificate to PEM
openssl x509 -inform der -in certificate.der -out certificate.pem

Replace these values

PlaceholderWhat to put there
-inform derRequired. Without it OpenSSL assumes PEM input and fails.
certificate.derThe binary input. Often named .cer or .crt.
certificate.pemBase64 output with BEGIN/END lines.

First, confirm what you actually have #

Files arrive with unhelpful extensions. Check the first two bytes rather than the name:

DER begins 0x30 0x82; PEM begins with a dash
head -c 2 mystery.cer | xxd
Expected output 
00000000: 3082                                     0.

Or let file do it:

file mystery.cer
Expected output 
mystery.cer: Certificate, Version=3

If the file turns out to be PEM already, there is nothing to convert — see converting a .crt to PEM for the rename-only case.

Other object types #

What the file holds Command
Certificate openssl x509 -inform der -in in.der -out out.pem
CSR openssl req -inform der -in in.der -out out.pem
Private key openssl pkey -inform der -in in.der -out out.pem
Public key openssl pkey -pubin -inform der -in in.der -pubout -out out.pem
PKCS#7 bundle openssl pkcs7 -inform der -in in.p7b -print_certs -out out.pem
CRL openssl crl -inform der -in in.crl -out out.pem
DER private key to PEM
openssl pkey -inform der -in private.der -out private.key

The common real-world case: an intermediate from a CA #

Certificate authorities publish intermediates in DER, linked from the Authority Information Access extension of the certificate they signed. Fetching one and appending it to a chain is the usual reason to run this conversion at all:

Fetch the intermediate, convert it, build the chain
curl -sO http://crt.example-ca.com/intermediate.der
openssl x509 -inform der -in intermediate.der -out intermediate.pem
cat certificate.crt intermediate.pem > fullchain.crt

That is the fix for unable to get local issuer certificate.

Verify the result # 

openssl x509 -in certificate.pem -noout -subject -issuer -enddate
Expected output 
subject=CN = example.com
issuer=C = US, O = Example CA, CN = Example Intermediate CA
notAfter=Nov 14 12:00:00 2026 GMT

If that prints the expected details, the conversion worked. If it errors, the input was not a certificate — go back and check which object type you actually have.

Frequently asked questions

Why do I get "PEM routines::no start line"?
Because you omitted -inform der. OpenSSL defaulted to PEM, looked for a -----BEGIN line in a binary file, and did not find one. See that error in detail.
My file is called .cer — is it DER or PEM?
The extension does not tell you. .cer is used for both. Check the first byte instead — 0x30 means DER, and a - character means PEM.
Can I convert a DER file containing a whole chain?
Not directly, because DER has no delimiters and a concatenation cannot be split reliably. A binary file holding several certificates is almost certainly PKCS#7, so try openssl pkcs7 -inform der -in bundle.p7b -print_certs instead.
Does this change the certificate's validity or fingerprint?
No. The encoding changes, the bytes being encoded do not. The signature stays valid and the SHA-256 fingerprint is identical before and after.

References

Related pages