Quote:To Convert Certificate Formats

To convert certificate formats, use openssl.exe, as follows:

To convert binary-only PKCS7 (.p7 .p7a .p7b .p7c) files as output from Windows Internet Explorer Certificate Manager, with single or multiple certificate content, and generate human readable text content in the output file:

openssl pkcs7 -inform DER -in filename.p7b -text -print_certs -out outfilename.pem

For example:

openssl pkcs7 -inform DER -in IECert.p7b -text -print_certs -out IECert.pem

To convert binary-only PKCS7 files as output from Windows Internet Explorer Certificate Manager, with single or multiple certificate content, and generate only binary content in the output file leave out the “-text” element:


openssl pkcs7 -inform DER -in filename.p7b -text -print_certs -out outfilename.pem

Example:

openssl pkcs7 -inform DER -in IECert.p7b -text -print_certs -out IECert.pem

When handling many certificates in one file you might encounter issues of space being taken for the descriptive text content. In these circumstances you may wish to remove the text content, however this is not recommended for normal use as it make handling of the certificates harder because their content is not immediately viewable.

Some applications do not accept X509v3 certificates when accompanied by a text description within the certificate file. You can overcome this for most applications, by editing the certificate to trim the text sections, but take care to leave intact the lines beginning and terminating the binary certificate data.
To convert PEM to PKCS#12 (to install in a Web browser or for storage):
If your PEM-format certificate and key are both in one file, use:

openssl pkcs12 -export -in pem-cert-and-key-file -out pkcs12-cert-and-key-file

If they are in separate files, use:

openssl pkcs12 -export -in pem-cert-file -inkey pem-key-file -out pkcs12-cert-and-key-file

Both these commands put the certificate and keyfile into one file. If you intend to store your private key and certificate together in this fashion you should apply a pass phrase to the resultant file.

To convert PKCS#12 to PEM:

openssl pkcs12 -in pkcs-12-cert-and-key-file -out pem-cert-and-key-file

To convert ASN.1 PEM files to DER PEM :
If the PEM file contains DSA keys, use:

openssl dsa -inform PEM -outform DER -in pem-file -out der-file

If it contains RSA Keys, use:

openssl rsa -inform PEM -outform DER -in pem-file -out der-file

To convert DER (.cer in most implementations) to PEM:
If the DER file contains DSA keys, use :

openssl dsa -inform DER -outform PEM -in der-file -out pem-file

If it contains RSA Keys, use:

openssl rsa -inform DER -outform PEM -in der-file -out pem-file

Multiple PEM Format Certificates

Normally there is only one certificate in a file. OpenSSL generally assumes this is the case, so it ignores any after the first when handling server and client certificates.

However, a file can contain multiple PEM and PKCS7 format certificates. This is useful for storing a bundle of the root certificates of the CAs you trust, or a certificate verification chain. To use the certificates, you will need to split the file into one file per certificate.

You can split the file using a text editor, but you must take care to not change the data for each individual certificate. Each certificate takes the following format and is terminated by the END CERTIFICATE line:

optional-header-info
------BEGIN optional-text CERTIFICATE-----
...
------END optional-text CERTIFICATE-----

As long as you do not change or break up the data within the BEGIN and END lines, the certificate itself is complete. A certificate is rendered useless unless it retains its binary composition that was created when it was originally signed.