SG PEM Converter & Validator

Security Tools

PEM Converter & Validator

Inspect certificates, CSRs, public keys, and certificate chains, and convert supported formats. Sensitive input is submitted to this website’s server for processing.

OpenSSL powered

Third-party website security warning: Never paste or upload a production private key, PFX/P12 file, key password, API secret, or other confidential cryptographic material to a public or third-party website. This plugin does not intentionally save submitted content, but the data is transmitted to and processed by this website’s WordPress server. The site owner, hosting provider, server logs, backups, monitoring systems, or security products may operate outside this plugin’s control. For sensitive production material, use OpenSSL locally or run this plugin only on a server you own and fully trust.

Paste PEM content

Upload file

Include detailed metadata Check chain ordering

Validation results

Paste or upload PEM data, then select Validate PEM.

Source format

Target format

Object type

PEM input

Binary input file

PKCS#12/private-key password

Converted output

DER output is returned as Base64 and downloaded as binary. PKCS#12 export can expose private-key material. Do not use a production PFX/P12 file or password on a third-party website.

Certificate or CSR

Private or public key

Safer option: Extract the public key locally and compare that instead.

The comparison uses public-key fingerprints; private-key material is never returned.

Common PEM blocks

-----BEGIN CERTIFICATE-----
-----BEGIN CERTIFICATE REQUEST-----
-----BEGIN PRIVATE KEY-----
-----BEGIN ENCRYPTED PRIVATE KEY-----
-----BEGIN RSA PRIVATE KEY-----
-----BEGIN PUBLIC KEY-----

OpenSSL validation

openssl x509 -in certificate.pem -text -noout
openssl req -in request.csr -text -noout
openssl pkey -in private.key -check -noout
openssl verify -CAfile chain.pem certificate.pem

Convert DER certificate to PEM

openssl x509 -inform DER -in certificate.der \
  -out certificate.pem

Convert PEM certificate to DER

openssl x509 -outform DER -in certificate.pem \
  -out certificate.der

Extract a PFX/P12 bundle

openssl pkcs12 -in bundle.p12 -out bundle.pem \
  -nodes

Remove -nodes when you want the exported private key encrypted.

Verify a key match

openssl x509 -in certificate.pem -pubkey -noout | sha256sum
openssl pkey -in private.key -pubout | sha256sum

Best practices

Public-site rule: Use certificates, CSRs, and public keys where possible. Process private keys and PFX/P12 bundles locally.
Protect private keys with restrictive file permissions such as chmod 600.
Never commit keys or PFX passwords to Git repositories.
Use PKCS#8 for new private-key storage and encrypt keys at rest.
Keep the leaf certificate first, followed by intermediate certificates. Usually omit the root certificate from the served chain.
Rotate compromised keys immediately; format conversion does not make an exposed key safe.

Your feedback matters

Was this post helpful?

0 reactions