# Convert PEM to P7B / PKCS#7

To bundle PEM certificates into a P7B, run `openssl crl2pkcs7 -nocrl -certfile certificate.crt -certfile chain.crt -out bundle.p7b`. The subcommand is named `crl2pkcs7` because its original purpose was wrapping certificate revocation lists, and `-nocrl` tells it there is no CRL to include — a certificates-only bundle is what you almost always want. Repeat `-certfile` once per input file. A P7B can never carry a private key; use PKCS#12 if you need the key in the same file.

Source: https://certguru.io/convert/pem-to-p7b/
Last updated: 2026-08-19
Commands verified against OpenSSL 3.5.7.

---

## The command

*Bundle a certificate and its chain into a P7B*

```bash
openssl crl2pkcs7 -nocrl \
  -certfile certificate.crt \
  -certfile chain.crt \
  -out bundle.p7b
```

| Placeholder | What to put there |
| --- | --- |
| `-nocrl` | No certificate revocation list is being included. Required for a certificates-only bundle. |
| `-certfile` | A PEM file to include. Repeat once per file; a file holding several certificates contributes all of them. |
| `bundle.p7b` | The PKCS#7 output, Base64-encoded by default. |

## Bundling a whole chain from one file

If your intermediates are already concatenated in a single PEM file, one `-certfile` covers them all:

```bash
openssl crl2pkcs7 -nocrl -certfile fullchain.crt -out bundle.p7b
```

## Producing binary DER output

Some Windows import dialogs will not accept the Base64 form:

```bash
openssl crl2pkcs7 -nocrl -certfile fullchain.crt -outform der -out bundle-der.p7b
```

## Verify the bundle

*List what ended up inside*

```bash
openssl pkcs7 -print_certs -in bundle.p7b -noout
```

Expected output:

```
subject=CN = example.com
issuer=C = US, O = Example CA, CN = Example Intermediate CA

subject=C = US, O = Example CA, CN = Example Intermediate CA
issuer=C = US, O = Example CA, CN = Example Root CA
```

Count the entries. A bundle with one fewer certificate than you expected usually means a
`-certfile` argument pointed at a path that does not exist — OpenSSL does not always complain
loudly about that.

> **P7B is a container, not a chain**
>
> PKCS#7 stores certificates as an unordered set. It is a convenient way to move a group of
>   certificates as one file, but it does not record which certificate signed which. Anything
>   consuming the bundle has to work the chain out from the subject and issuer names.

## Going the other way

See [convert P7B to PEM](/convert/p7b-to-pem/).


## Frequently asked questions

### Why is the subcommand called crl2pkcs7?

Because it was written to wrap certificate revocation lists into PKCS#7 structures. Bundling certificates is a secondary use, which is why you have to pass `-nocrl` to say you are not supplying a CRL. There is no better-named alternative in OpenSSL.

### Can I include the private key?

No. PKCS#7 has no structure for private keys. Use PKCS#12 when you need the certificate and its key in one file.

### Should the output be DER or PEM?

Base64 PEM is the default and is what most tools expect from a `.p7b`. Add `-outform der` if the consuming system specifically wants binary, which some older Windows tooling does.

### Does the order of -certfile arguments matter?

Not for correctness — PKCS#7 is an unordered set and no consumer should rely on the order. Passing the leaf first is still a good habit, because it makes the output easier to read when someone unpacks it later.


## References

- [openssl-crl2pkcs7(1)](https://docs.openssl.org/3.5/man1/openssl-crl2pkcs7/) — wrapping certificates into a PKCS#7 bundle
- [RFC 5652: cryptographic message syntax](https://www.rfc-editor.org/rfc/rfc5652) — CMS, which PKCS#7 became

## Related pages

- https://certguru.io/convert/p7b-to-pem/
- https://certguru.io/formats/pkcs7-p7b/
- https://certguru.io/convert/pem-to-pfx/
- https://certguru.io/formats/pem/
- https://certguru.io/platforms/iis/

--
CertGuru — https://certguru.io