CertGuru

Convert PEM to DER

To convert a PEM certificate to DER, run `openssl x509 -in certificate.pem -outform der -out certificate.der`. DER is the raw binary encoding of the same data; PEM is that binary Base64-encoded and wrapped in `-----BEGIN CERTIFICATE-----` header and footer lines. Nothing is added or lost in either direction. Use a different subcommand for other object types: `openssl req` for a CSR and `openssl pkey` for a private key, because each parses a different ASN.1 structure.

Updated August 19, 2026 Verified against OpenSSL 3.5.7

Certificates #

PEM certificate to DER
openssl x509 -in certificate.pem -outform der -out certificate.der

Replace these values

PlaceholderWhat to put there
certificate.pemThe Base64 input, starting with -----BEGIN CERTIFICATE-----.
-outform derTells OpenSSL to write raw binary rather than PEM.
certificate.derThe binary output file.

The input format is detected automatically, so -inform pem is not needed here. Being explicit does no harm in a script where the input might vary.

Certificate signing requests #

A CSR is a different ASN.1 structure, so openssl x509 will not parse it. Use openssl req:

PEM CSR to DER
openssl req -in request.csr -outform der -out request.der

Private keys #

openssl pkey handles every key algorithm, which makes it the one to remember. The older openssl rsa and openssl ec subcommands still work but only for their own key type:

PEM private key to DER
openssl pkey -in private.key -outform der -out private.der

For a public key, add -pubin and -pubout:

openssl pkey -pubin -in public.pem -outform der -pubout -out public.der

What each subcommand handles #

PEM header in the file Subcommand Object
BEGIN CERTIFICATE openssl x509 An X.509 certificate
BEGIN CERTIFICATE REQUEST openssl req A CSR
BEGIN PRIVATE KEY openssl pkey PKCS#8 private key, any algorithm
BEGIN RSA PRIVATE KEY openssl rsa or openssl pkey PKCS#1 RSA private key
BEGIN EC PRIVATE KEY openssl ec or openssl pkey SEC1 EC private key
BEGIN PKCS7 openssl pkcs7 A PKCS#7 / P7B bundle
BEGIN X509 CRL openssl crl A certificate revocation list

If you are not sure which you have, read the first line:

head -n1 mystery.pem

Verify the conversion #

The most convincing check is that the fingerprint is unchanged, because that hashes the actual certificate bytes:

Both commands must print the same fingerprint
openssl x509 -in certificate.pem -noout -fingerprint -sha256
openssl x509 -inform der -in certificate.der -noout -fingerprint -sha256
Expected output 
sha256 Fingerprint=A1:B2:C3:...
sha256 Fingerprint=A1:B2:C3:...

Going the other way #

See convert DER to PEM.

Frequently asked questions

Does converting to DER change the certificate?
No. PEM is DER that has been Base64-encoded and given header and footer lines. Converting between them re-encodes the same bytes, so the signature stays valid and the fingerprint is unchanged.
Why does openssl x509 fail on my PEM file?
Because the file is not a certificate. openssl x509 only parses certificates. If the file begins -----BEGIN CERTIFICATE REQUEST----- use openssl req, and if it begins -----BEGIN PRIVATE KEY----- use openssl pkey.
Can a DER file hold more than one certificate?
Not usefully. DER has no delimiter between objects, so a concatenation of two DER certificates cannot be reliably split. Chains are why PKCS#7 and PKCS#12 exist. PEM can hold many certificates in one file precisely because its BEGIN and END lines act as delimiters.
What extension should a DER file have?
There is no enforced convention. .der and .cer are both common, and Windows tooling often uses .cer for DER while other platforms use .cer for PEM. Never infer the encoding from the extension; check the first byte instead.

References

Related pages