# Convert P7B / PKCS#7 to PEM

To convert a P7B bundle to PEM, run `openssl pkcs7 -print_certs -in bundle.p7b -out certificates.pem`. If the file is binary rather than Base64 text, add `-inform der`. A P7B holds certificates only and never a private key, so the output is a concatenation of every certificate in the bundle — typically your server certificate plus the intermediates. The certificates come out in the order the bundle stored them, which is not guaranteed to be chain order, so check before using the file as a chain.

Source: https://certguru.io/convert/p7b-to-pem/
Last updated: 2026-08-19
Commands verified against OpenSSL 3.5.7.

---

## The command

*Unpack a P7B into PEM certificates*

```bash
openssl pkcs7 -print_certs -in bundle.p7b -out certificates.pem
```

If that fails with `PEM routines::no start line`, the bundle is DER-encoded rather than Base64:

*Binary P7B*

```bash
openssl pkcs7 -inform der -print_certs -in bundle-der.p7b -out certificates.pem
```

| Placeholder | What to put there |
| --- | --- |
| `-print_certs` | Emit the certificates the bundle contains, rather than the PKCS#7 wrapper itself. |
| `-inform der` | Needed when the .p7b is binary. Check the first line to find out. |
| `certificates.pem` | Output: every certificate in the bundle, concatenated. |

## Which certificate is which?

The output is a pile of certificates with no labels, and PKCS#7 does not record chain order. Read
the subject and issuer of each one and reconstruct the chain yourself:

*List subject and issuer for every certificate in the file*

```bash
openssl crl2pkcs7 -nocrl -certfile certificates.pem \
  | openssl pkcs7 -print_certs -noout
```

Expected output:

```
subject=CN = example.com
issuer=C = US, O = Example CA, CN = Example Intermediate CA

subject=C = US, O = Example CA, CN = Example Intermediate CA
issuer=C = US, O = Example CA, CN = Example Root CA
```

Read it as a linked list. The certificate whose **subject** is your hostname is the leaf. The one
whose subject matches the leaf's **issuer** is the next link up, and so on. A certificate whose
subject and issuer are identical is a self-signed root — which normally should *not* go into a
server chain file, because clients that already trust it do not need it and clients that do not
trust it will not start trusting it because you sent it.

## Splitting into separate files

*Write each certificate to its own numbered file*

```bash
csplit -z -f cert- -b '%02d.pem' certificates.pem '/-----BEGIN CERTIFICATE-----/' '{*}'
```

Then inspect each:

```bash
for f in cert-*.pem; do echo "== $f"; openssl x509 -in "$f" -noout -subject -issuer; done
```

## Building a usable chain file

Once you know the order, concatenate leaf-first. That is what nginx, Apache and HAProxy expect:

```bash
cat cert-00.pem cert-01.pem > fullchain.crt
```

Confirm it verifies before deploying:

```bash
openssl verify -CAfile root-ca.crt -untrusted cert-01.pem cert-00.pem
```

Expected output:

```
cert-00.pem: OK
```

> **Where P7B files come from**
>
> Windows and Java tooling export P7B when you ask for "certificate chain without the key", and some
>   CAs still deliver bundles in this format by default. If you also need the private key in the same
>   file, you want [PKCS#12](/formats/pkcs12-pfx-p12/), not PKCS#7.

## Going the other way

See [convert PEM to P7B](/convert/pem-to-p7b/).


## Frequently asked questions

### Does a P7B contain the private key?

No, and it cannot. PKCS#7 is a certificate and CRL transport format with no provision for private keys at all. If you need certificate and key in one file you want PKCS#12 instead.

### Why does my output file contain a lot of extra text?

`-print_certs` writes a human-readable subject and issuer line above each certificate. Every tool that reads PEM ignores those lines, but if you want a clean file, pipe the result through `openssl x509` or strip everything outside the BEGIN/END markers.

### What is the difference between .p7b, .p7c and .spc?

They are the same PKCS#7 structure under different extensions. `.p7b` and `.p7c` are the usual names, and `.spc` is a Microsoft software-publishing variant. All three open with the same command.

### The certificates came out in the wrong order — does that matter?

For a server chain, yes. PKCS#7 is an unordered set, so a bundle carries no guarantee that its contents are in chain order. Read each certificate's subject and issuer and rebuild the file leaf-first before handing it to a web server.


## References

- [openssl-pkcs7(1)](https://docs.openssl.org/3.5/man1/openssl-pkcs7/) — -print_certs
- [RFC 5652: cryptographic message syntax](https://www.rfc-editor.org/rfc/rfc5652) — CMS, which PKCS#7 became

## Related pages

- https://certguru.io/convert/pem-to-p7b/
- https://certguru.io/formats/pkcs7-p7b/
- https://certguru.io/errors/keytool-not-an-x509-certificate/
- https://certguru.io/formats/pem/
- https://certguru.io/convert/pfx-to-pem/
- https://certguru.io/concepts/certificate-chain/

--
CertGuru — https://certguru.io