How to convert between PEM and DER

Two wrappings of exactly the same bytes. One is text you can paste; the other is binary.

DER is the binary encoding of a key or certificate. PEM is that same binary, Base64-encoded and wrapped in -----BEGIN…----- lines so it survives being pasted into a config file or an email.

Converting between them changes nothing about the content. It is packaging, not translation — which is why a converted file has an identical fingerprint to what you started with.

Step-by-step

1. Paste PEM, or load a DER file. The tool works out which you have given it.
2. Read the other form. Copy the PEM, or download the DER.

Which one does a given tool want?

• PEM — most Unix tooling, web servers, and anything where the value goes in a text config or an environment variable. Files ending .pem, .crt, .key are usually PEM.
• DER — Java keystores, some Windows tooling, and various embedded systems. Files ending .der or .cer are often DER, though .cer is used for both.

The extension is a convention, not a guarantee. If a file opens in a text editor and starts with BEGIN, it is PEM whatever it is called.

What the tool will not do

It refuses to re-encode between structural formats — turning PKCS#1 into PKCS#8, for instance — rather than attempting it. Those conversions change the bytes and their meaning, and doing them silently while calling it a format conversion is how people end up with a key their software rejects for reasons nobody can explain. If you need that, use a tool that is explicit about performing it.

Frequently asked questions

Does converting change my key?

No. The underlying bytes are identical; only the wrapping differs. The fingerprint before and after is the same.

How do I tell what I have?

Open it in a text editor. If it begins with -----BEGIN, it is PEM. If it is unreadable binary, it is DER.

Can it convert PKCS#1 to PKCS#8?

No, deliberately. That is a change of structure rather than of encoding, and the tool refuses it rather than doing it quietly under the label of a format conversion.