The same SSL certificate can be stored in several different file formats. cPanel, Apache and Nginx require the text (PEM) format, whilst Windows servers (IIS) and many network devices require a single, password-protected PFX file. This article explains the different formats and how to convert between them using OpenSSL, which is available by default on Linux and macOS.

Formats

Format	Extension	Contents	Who uses it?
PEM	.pem, .crt, .cer, .key	Text (Base64), starting with the line -----BEGIN ...-----. A single file may contain multiple certificates and keys.	cPanel, Apache, Nginx, most Linux software
DER	.der, .cer	It is the same as the PEM, but in binary format.	Java, certain Windows applications
PKCS#7	.p7b, .p7c	It contains only certificates (and intermediate certificates); it does not contain any private keys.	Windows, Tomcat
PKCS#12	.pfx, .p12	The certificate, intermediate certificates and private key are stored in a single, password-protected binary file.	Windows/IIS, Exchange, Azure, and a wide range of networking tools

The .crt and .cer extensions can be misleading: the files may be in either PEM or DER format. If, when you open the file in a text editor, you see the line -----BEGIN CERTIFICATE-----, it is in PEM format.

On the client portal, from the certificates page, you can download the certificate, the intermediate certificate and the private key (if generated by the portal) either individually or together in PEM format.

Redesign

PEM → PFX (e.g. for a Windows server)

openssl pkcs12 -export -out pelda.hu.pfx \
  -inkey pelda.hu.key -in pelda.hu.crt -certfile ca-bundle.crt

The command prompts you for a password, which will be used to protect the PFX file. You must enter the password when importing the file.

OpenSSL 3 creates the PFX file using a form of encryption that older versions of Windows (such as Windows Server 2016) cannot read. In this case, add the -legacy switch:

openssl pkcs12 -export -legacy -out pelda.hu.pfx \
  -inkey pelda.hu.key -in pelda.hu.crt -certfile ca-bundle.crt

PFX → PEM (e.g. for cPanel or a Linux server)

# A privát kulcs
openssl pkcs12 -in pelda.hu.pfx -nocerts -nodes -out pelda.hu.key

# A tanúsítvány
openssl pkcs12 -in pelda.hu.pfx -clcerts -nokeys -out pelda.hu.crt

# A köztes tanúsítványok
openssl pkcs12 -in pelda.hu.pfx -cacerts -nokeys -out ca-bundle.crt

Due to the -nodes switch, the private key displayed will not be password-protected, so please treat it as confidential.

DER ↔ PEM

# DER → PEM
openssl x509 -inform der -in pelda.hu.der -out pelda.hu.crt

# PEM → DER
openssl x509 -outform der -in pelda.hu.crt -out pelda.hu.der

P7B → PEM

openssl pkcs7 -print_certs -in pelda.hu.p7b -out pelda.hu.pem

Useful checks

Displaying the certificate details (to whom it is issued, who issued it, and its expiry date):

openssl x509 -in pelda.hu.crt -noout -subject -issuer -dates -ext subjectAltName

Do the certificate and private key belong together? The output of the two commands must match:

openssl x509 -in pelda.hu.crt -noout -pubkey | openssl sha256
openssl pkey -in pelda.hu.key -pubout | openssl sha256

If it differs, the key belongs to a different certificate (for example, a previous CSR). In this case, cPanel will not allow you to install the certificate either. Find the correct key, or generate a new key and CSR, and reissue the certificate.

Further information on other ways to check expiry dates can be found in the article ‘How can I check when my SSL certificate expires?’, whilst information on intermediate certificates can be found in the article ‘What is an intermediate certificate (CA bundle)?’.