How do I convert a certificate between .pem format and .der/.crt/.cer format?

The following openssl commands can be used to convert a certificate in PEM (plain text) format to DER (binary) format, and vice-versa.

The basic command to convert a PEM certificate to DER format is:

$ openssl x509 -in MYCERT.pem -out MYCERT.der -outform DER

To convert from a DER certificate to PEM format is:

$ openssl x509 -in MYCERT.der -out MYCERT.pem -inform DER

(Note: In all cases, openssl considers PEM the default format, unless otherwise specified by -inform or -outform.)

In some cases, the application using a binary DER certificate may require the file name to end in .crt or .cer. There is no difference in the internal format with any of these “types”. Simply replace the extension of the file name used with the -out option accordingly.

$ openssl x509 -in MYCERT.pem -out MYCERT.crt -outform DER
$ openssl x509 -in MYCERT.pem -out MYCERT.cer -outform DER

For more information, please see the OpenSSL x509 documentation available here.