DER is the binary encoding. PEM is the same bytes in Base64, wrapped in -----BEGIN X----- and -----END X----- lines so they can be pasted into a text file. Converting between them changes the container, never the key.
Why conversion is needed
Tools disagree about which they accept:
- Java keytool and older JVM tooling often want DER.
- OpenSSL, nginx and Apache default to PEM.
- Windows and .NET use
.pfx/.p12, which is PKCS#12 — a different, encrypted container this tool does not handle. - AWS, Google Cloud and most APIs accept PEM.
The file extension is not authoritative. A .crt may be either encoding, and a .pem may contain a certificate, a key, or both.
Reading the structure panel
The structure output reads the ASN.1 markers and names what it finds. This answers the question that usually prompted the conversion: what *is* this file?
rsaEncryptionOID — an RSA key.id-ecPublicKeyOID plus a curve OID — an EC key, and which curve.Ed25519OID — an Edwards curve key.- Outer type not a SEQUENCE — probably not DER at all. A
.derfile that starts with0x2Dis actually PEM text.
PEM labels are not interchangeable
The label declares the internal structure, and getting it wrong produces a file that looks valid and fails to parse:
| Label | Contains |
|---|---|
PUBLIC KEY | SPKI — any algorithm |
PRIVATE KEY | PKCS#8 — any algorithm |
RSA PRIVATE KEY | PKCS#1 — RSA only |
EC PRIVATE KEY | SEC1 — EC only |
CERTIFICATE | An X.509 certificate |
CERTIFICATE REQUEST | A PKCS#10 CSR |
Wrapping a PKCS#8 key in an RSA PRIVATE KEY label does not convert it. The tool that reads it will try to parse PKCS#1 and fail.
Certificate chains
A PEM file can hold several concatenated blocks — a leaf certificate followed by intermediates. DER cannot: it holds exactly one structure. Converting a chain to DER requires splitting it first, and a converter that silently takes only the first block is a common source of incomplete chains in production.
This tool converts the first block it finds and reports its label, so you can see what you got.
Frequently asked questions
Which format does my tool need?
Try PEM first — it is the more common default and it is human-inspectable, which makes debugging easier. Switch to DER only if the tool explicitly rejects PEM.
Can I convert a .pfx or .p12 file?
No. PKCS#12 is an encrypted container holding a key and its certificate chain, and it requires the password to open. Use openssl pkcs12 -in file.pfx -out file.pem -nodes locally.
Does converting change the key?
No. The bytes are identical; only the wrapping differs. A key converted PEM to DER and back is byte-for-byte the original.
How do I check a key and certificate match?
Compare the public key from each: openssl x509 -pubkey -noout -in cert.pem against openssl rsa -pubout -in key.pem. Paste both into the hash comparator to confirm they are identical.