Why is the subcommand called crl2pkcs7?

Because it was written to wrap certificate revocation lists into PKCS#7 structures. Bundling certificates is a secondary use, which is why you have to pass -nocrl to say you are not supplying a CRL. There is no better-named alternative in OpenSSL.

Can I include the private key?

No. PKCS#7 has no structure for private keys. Use PKCS#12 when you need the certificate and its key in one file.

Should the output be DER or PEM?

Base64 PEM is the default and is what most tools expect from a .p7b . Add -outform der if the consuming system specifically wants binary, which some older Windows tooling does.

Does the order of -certfile arguments matter?

Not for correctness — PKCS#7 is an unordered set and no consumer should rely on the order. Passing the leaf first is still a good habit, because it makes the output easier to read when someone unpacks it later.

Convert PEM to P7B / PKCS#7

To bundle PEM certificates into a P7B, run `openssl crl2pkcs7 -nocrl -certfile certificate.crt -certfile chain.crt -out bundle.p7b`. The subcommand is named `crl2pkcs7` because its original purpose was wrapping certificate revocation lists, and `-nocrl` tells it there is no CRL to include — a certificates-only bundle is what you almost always want. Repeat `-certfile` once per input file. A P7B can never carry a private key; use PKCS#12 if you need the key in the same file.

Updated August 19, 2026 Verified against OpenSSL 3.5.7

The command #

Bundle a certificate and its chain into a P7B

openssl crl2pkcs7 -nocrl \
-certfile certificate.crt \
-certfile chain.crt \
-out bundle.p7b

Replace these values

Placeholder	What to put there
`-nocrl`	No certificate revocation list is being included. Required for a certificates-only bundle.
`-certfile`	A PEM file to include. Repeat once per file; a file holding several certificates contributes all of them.
`bundle.p7b`	The PKCS#7 output, Base64-encoded by default.

Bundling a whole chain from one file #

If your intermediates are already concatenated in a single PEM file, one -certfile covers them all:

openssl crl2pkcs7 -nocrl -certfile fullchain.crt -out bundle.p7b

Producing binary DER output #

Some Windows import dialogs will not accept the Base64 form:

openssl crl2pkcs7 -nocrl -certfile fullchain.crt -outform der -out bundle-der.p7b

Verify the bundle #

List what ended up inside

openssl pkcs7 -print_certs -in bundle.p7b -noout

Expected output

subject=CN = example.com
issuer=C = US, O = Example CA, CN = Example Intermediate CA

subject=C = US, O = Example CA, CN = Example Intermediate CA
issuer=C = US, O = Example CA, CN = Example Root CA

Count the entries. A bundle with one fewer certificate than you expected usually means a -certfile argument pointed at a path that does not exist — OpenSSL does not always complain loudly about that.

Going the other way #

See convert P7B to PEM.

Frequently asked questions

Why is the subcommand called crl2pkcs7?: Because it was written to wrap certificate revocation lists into PKCS#7 structures. Bundling certificates is a secondary use, which is why you have to pass -nocrl to say you are not supplying a CRL. There is no better-named alternative in OpenSSL.
Can I include the private key?: No. PKCS#7 has no structure for private keys. Use PKCS#12 when you need the certificate and its key in one file.
Should the output be DER or PEM?: Base64 PEM is the default and is what most tools expect from a .p7b. Add -outform der if the consuming system specifically wants binary, which some older Windows tooling does.
Does the order of -certfile arguments matter?: Not for correctness — PKCS#7 is an unordered set and no consumer should rely on the order. Passing the leaf first is still a good habit, because it makes the output easier to read when someone unpacks it later.

References

openssl-crl2pkcs7(1) — wrapping certificates into a PKCS#7 bundle
RFC 5652: cryptographic message syntax — CMS, which PKCS#7 became