DIGITALTRUST

Tools / SSL converter

SSL converter

Tell us where the certificate is going (Plesk, nginx, Windows, HAProxy, Java) and get the right files. PEM, DER, P7B and PFX, without the key leaving your computer.

The private key never leaves your computer. Unlike other online converters, this one does not send the file to any server: the conversion happens in this browser. It works with RSA and ECDSA keys. If you prefer the command line:
openssl x509 -in certificate.pem -outform der -out certificate.cer         # PEM → DER
openssl crl2pkcs7 -nocrl -certfile fullchain.pem -out certificate.p7b      # PEM → P7B
openssl pkcs7 -print_certs -in certificate.p7b -out certificate.pem        # P7B → PEM
openssl pkcs12 -export -inkey private.key -in fullchain.pem -out company.pfx # PEM → PFX
openssl pkcs12 -in company.pfx -out company.pem -nodes                     # PFX → PEM

Reads PEM, DER, P7B and PFX (including modern OpenSSL 3 PFX files with AES). The generated PFX uses 3DES and a SHA-1 MAC, the format every version of Windows and IIS imports. The chain order is fixed automatically, and the root is left out when it should not be installed.

By API or with AI assistants. This tool works with private keys, so it is not in the API: a private key should never pass through third-party servers. API and MCP documentation.
Other tools

More checks, no sign-up.

SSL/TLS checker

Test the certificate, chain and protocols of any server: website, mail server or API.

Certificate decoder

See what is inside a certificate: names, validity, issuer, validation type and fingerprints.

CSR decoder

Check your certificate request before you send it: names, organisation, key and signature.

CSR generator

Create the private key and the CSR in your browser, or copy a ready-made OpenSSL command.

Key matcher

Confirm that a certificate, a CSR and a private key belong together.

Certificate Transparency lookup

Find every valid certificate issued for your domain and its subdomains in the public Certificate Transparency logs.

CAA checker

See which Certification Authorities may issue for your domain, before you order.

Email security check

Check SPF, DKIM, DMARC, BIMI, MTA-STS and TLS-RPT for your domain in one test.
CallOrder SSL