To Convert Certificate Formats

To convert certificate formats, use openssl.exe, as follows:

• To convert binary-only PKCS7 (.p7 .p7a .p7b .p7c) files as output from Windows Internet Explorer Certificate Manager, with single or multiple certificate content, and generate human readable text content in the output file:

  	openssl pkcs7 -inform DER -in filename.p7b -text -print_certs -out outfilename.pem

  For example:

  openssl pkcs7 -inform DER -in IECert.p7b -text -print_certs -out IECert.pem

• To convert binary-only PKCS7 files as output from Windows Internet Explorer Certificate Manager, with single or multiple certificate content, and generate only binary content in the output file leave out the “-text” element:

   
  openssl pkcs7 -inform DER -in filename.p7b -text -print_certs -out outfilename.pem
  

  Example:

  openssl pkcs7 -inform DER -in IECert.p7b -text -print_certs -out IECert.pem
  

  When handling many certificates in one file you might encounter issues of space being taken for the descriptive text content. In these circumstances you may wish to remove the text content, however this is not recommended for normal use as it make handling of the certificates harder because their content is not immediately viewable.

  Some applications do not accept X509v3 certificates when accompanied by a text description within the certificate file. You can overcome this for most applications, by editing the certificate to trim the text sections, but take care to leave intact the lines beginning and terminating the binary certificate data.

• To convert PEM to PKCS#12 (to install in a Web browser or for storage):
  • If your PEM-format certificate and key are both in one file, use:

    openssl pkcs12 -export -in pem-cert-and-key-file -out pkcs12-cert-and-key-file

  • If they are in separate files, use:

    openssl pkcs12 -export -in pem-cert-file -inkey pem-key-file -out pkcs12-cert-and-key-file

  Both these commands put the certificate and keyfile into one file. If you intend to store your private key and certificate together in this fashion you should apply a pass phrase to the resultant file.

• To convert PKCS#12 to PEM:

  • openssl pkcs12 -in pkcs-12-cert-and-key-file -out pem-cert-and-key-file

• To convert ASN.1 PEM files to DER PEM :
  • If the PEM file contains DSA keys, use:

    openssl dsa -inform PEM -outform DER -in pem-file -out der-file

  • If it contains RSA Keys, use:

    openssl rsa -inform PEM -outform DER -in pem-file -out der-file

• To convert DER (.cer in most implementations) to PEM:
  • If the DER file contains DSA keys, use :

    openssl dsa -inform DER -outform PEM -in der-file -out pem-file

  • If it contains RSA Keys, use:

    openssl rsa -inform DER -outform PEM -in der-file -out pem-file