Certificate Formats: PEM vs DER vs PFX and Where Each One Is Used

One certificate, several encodings — and every platform expects its own:

• PEM: Base64 text between -----BEGIN CERTIFICATE----- markers. The standard on Linux/nginx/Apache; the same container is used for keys (PRIVATE KEY) and CSRs. A PEM “fullchain” file is simply leaf plus intermediates concatenated.
• DER: the binary form of the same structure. Common in Java ecosystems and some hardware devices; Windows also accepts it for certificates alone.
• PFX / PKCS#12: a binary bundle containing certificate + private key + chain, protected by a password. The standard exchange format for IIS/Windows and macOS imports.

Conversions you will actually need

openssl pkcs12 -export -out site.pfx -inkey site.key -in site.crt -certfile chain.crt
openssl pkcs12 -in site.pfx -nokeys -out site-fullchain.crt
openssl x509 -in site.crt -outform der -out site.der

The first builds a PFX for an IIS import; the second splits a PFX back into a certificate chain; the third produces DER. Anything else is a variation on these three.

Handling rules

Because a PFX contains the private key, moving a PFX between servers is effectively moving the site’s SSL identity — treat the file like a password. Export with a strong password, transfer it over a secure channel, and delete it from temporary locations after import; an old PFX with a weak password sitting in a downloads folder is an incident waiting to happen.

If you need to build a PFX from a PEM key and certificate — for example to install a Let’s Encrypt certificate on IIS — the WhoDNS PFX builder does the pkcs12 export in the browser, and its decoder counterpart lets you open an existing PFX to verify what is inside before you install it.

🔗 Related tool: Build a PFX file from your certificate and key