Paste an X.509 certificate in PEM format, including the BEGIN CERTIFICATE and END CERTIFICATE lines.
OpenSSL command examples
Inspect a PEM certificate
openssl x509 -in certificate.pem -text -noout
Print subject, issuer, and dates
openssl x509 -in certificate.pem -noout -subject -issuer -dates
Calculate a SHA-256 fingerprint
openssl x509 -in certificate.pem -noout -fingerprint -sha256
Paste a PEM-formatted certificate signing request, including its BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST lines.
OpenSSL command examples
Inspect and verify a CSR
openssl req -in request.csr -text -noout -verify
Print only the CSR subject
openssl req -in request.csr -noout -subject
Paste the PEM certificate whose public key will be compared with the private key below.
Paste the PEM private key to verify that it belongs to the certificate above. The key is processed only for this request.
Enter the passphrase only when the supplied private key is encrypted.
OpenSSL command examples

The two SHA-256 values must be identical. OpenSSL will prompt when the private key is encrypted.

Certificate public-key hash
openssl x509 -in certificate.pem -pubkey -noout | openssl pkey -pubin -outform DER | openssl sha256
Private-key public-key hash
openssl pkey -in private-key.pem -pubout -outform DER | openssl sha256
Paste the issued PEM certificate that you want to compare with the CSR.
Paste the original PEM CSR. Subject details and the public key will be checked against the certificate above.
OpenSSL command examples

Matching hashes confirm that the certificate was issued for the CSR key pair.

CSR public-key hash
openssl req -in request.csr -pubkey -noout | openssl pkey -pubin -outform DER | openssl sha256
Certificate public-key hash
openssl x509 -in certificate.pem -pubkey -noout | openssl pkey -pubin -outform DER | openssl sha256
Enter the two-letter ISO country code, for example BG or US.
Enter the full state, province, or region name.
Enter the city or locality associated with the certificate subject.
Enter the legal organization or personal name for the CSR subject.
Enter the department or business unit, such as IT or Operations.
Enter a contact email address to include in the CSR subject.
Enter the primary fully qualified domain name, for example www.example.com.
Choose whether OpenSSL should generate an RSA or elliptic-curve private key.
Select the RSA key strength. 2048 bits is the common minimum.
Choose the hash algorithm used to sign the CSR.
Select the elliptic curve used to generate an EC private key.
OpenSSL command examples

The -nodes option creates an unencrypted RSA private key. Remove it when you want OpenSSL to protect the key with a passphrase.

Generate an RSA key and CSR
openssl req -new -newkey rsa:2048 -nodes -keyout private-key.pem -out request.csr -subj "/C=BG/ST=Sofia/L=Sofia/O=Example/OU=IT/CN=www.example.com/[email protected]"
Generate an EC key and CSR
openssl ecparam -name prime256v1 -genkey -noout -out ec-private-key.pem
openssl req -new -key ec-private-key.pem -out request.csr -subj "/C=BG/ST=Sofia/L=Sofia/O=Example/OU=IT/CN=www.example.com"
Select the format of the certificate or bundle you are providing.
Select the different format that should be generated for download.
Upload the source certificate or bundle. Binary DER, P7B, PFX, and P12 input must be provided as a file; maximum size is 200 KB.
Instead of uploading a PEM file, paste its complete BEGIN/END certificate blocks here. A selected file takes priority.
Upload the PEM private key matching the leaf certificate when creating a PFX bundle.
Alternatively, paste the complete PEM private-key block. A selected key file takes priority.
Add an intermediate or CA chain file in PEM, DER, or P7B format.
Add another intermediate certificate when the chain uses more than one issuer.
Enter the password required to open the source PFX or encrypted private key.
Set the password used to protect the generated PFX or exported PEM private key.

Certificate Format Guide

Certificate formats often contain the same X.509 data but package and encode it differently. File extensions are useful hints, not reliable proof of a file's actual format.

Standard PEM

PEM is a text representation built from Base64 data surrounded by labels such as -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----. Common extensions include .pem, .crt, .cer, and .key.

A PEM file may hold a server certificate, intermediate certificates, or a private key. Multiple blocks can be placed in one file, although many server configurations keep the leaf certificate, chain, and private key in separate files.

PEM is widely used by Apache, Nginx, HAProxy, and OpenSSL-based software.

DER / Binary

DER stores the certificate as binary ASN.1 instead of Base64 text. Files commonly use .der or .cer. A .cer extension alone does not identify whether the content is DER or PEM.

DER is common in Java and in systems that expect one binary certificate per file. This converter exports the first certificate to DER; it does not use DER output for a certificate chain or private key.

PKCS#7 / P7B

PKCS#7 bundles one or more certificates and is commonly saved as .p7b or .p7c. It may be binary DER or Base64 text with BEGIN PKCS7 and END PKCS7 labels.

A P7B bundle can contain the server certificate and its intermediate or root chain, but it cannot contain a private key. Windows certificate tools, Java, and Tomcat commonly support this format.

PKCS#12 / PFX

PKCS#12 is an encrypted-capable binary container, normally using .pfx or .p12. One file can carry a server certificate, its chain, and the matching private key.

PFX is frequently used to move a certificate identity between Windows servers and other platforms. Exporting PFX to PEM can produce several certificate blocks plus a private-key block; separate them if the target application expects individual files.

Private-key safety: for sensitive production keys, perform PFX conversions locally so the key never leaves your computer. The commands below prompt for passwords instead of placing them directly in the command line.

Local OpenSSL Conversion Commands

Run these commands in a protected working directory and replace the example filenames with your own.

PEM to DER

openssl x509 -in certificate.pem -outform DER -out certificate.der

PEM to P7B

openssl crl2pkcs7 -nocrl -certfile certificate.pem -certfile chain.pem -out certificate.p7b

PEM to PFX

openssl pkcs12 -export -in certificate.pem -inkey private-key.pem -certfile chain.pem -out certificate.pfx

DER to PEM

openssl x509 -inform DER -in certificate.der -out certificate.pem

P7B to PEM

openssl pkcs7 -print_certs -in certificate.p7b -out certificates.pem

Add -inform DER when the P7B file uses binary encoding.

P7B to PFX

openssl pkcs7 -print_certs -in certificate.p7b -out certificates.pem
openssl pkcs12 -export -in server-certificate.pem -inkey private-key.pem -certfile chain.pem -out certificate.pfx

After the first command, separate the server certificate from the chain before creating the PFX.

PFX to PEM

openssl pkcs12 -in certificate.pfx -out certificate-and-key.pem -nodes

-nodes writes an unencrypted private key. Protect the output file and delete it securely when it is no longer needed.

Enter an HTTPS website address. The server will connect to it and display its TLS certificate and available chain.
OpenSSL command examples

Replace www.example.com with the target hostname. Press Ctrl+C after reviewing an interactive s_client connection.

Inspect a site's TLS connection and certificate chain
openssl s_client -connect www.example.com:443 -servername www.example.com -showcerts
Inspect a saved server certificate
openssl x509 -in server-certificate.pem -text -noout

Enter a MAC address to see the manufacturer/vendor of the NIC. Now you can do the opposite, enter a manufacturer/vendor name to see the mac address' of that organization.

Enter a complete MAC address to identify the registered hardware vendor.
Alternatively, enter part of a manufacturer name to find its registered MAC prefixes.
       

Online calculator to determine if two IP addresses are on the same network.


If two IP addresses are on the same network, they can communicate with each other without a network router. If two IP addresses are on different networks, you will need to route packets between them.


Enter the first IPv4 address to compare.
Enter the second IPv4 address to compare.
Enter the dotted-decimal subnet mask used by both addresses.
Paste the PEM CSR containing the subject and public key for the certificate to be generated.
Set how many days the generated certificate will remain valid.
Choose the hash algorithm OpenSSL will use for the certificate signature.
Create a self-signed certificate or sign the CSR with an existing CA certificate and key.
Paste the PEM CA certificate that will act as issuer when signing with a CA.
For self-signed output, provide the key matching the CSR. For CA signing, provide the private key matching the CA certificate.
Enter the passphrase when the CSR or CA signing private key is encrypted.
OpenSSL command examples

OpenSSL prompts for the private-key passphrase when an encrypted key is used.

Self-sign a CSR
openssl x509 -req -in request.csr -signkey private-key.pem -days 365 -sha256 -out certificate.pem
Sign a CSR with a CA
openssl x509 -req -in request.csr -CA ca-certificate.pem -CAkey ca-private-key.pem -CAcreateserial -days 365 -sha256 -out certificate.pem