WIndows integrated utility to convert DER to PEM

Question

Is there a utility that is available in standard windows 7 installations, that allows me to convert DER-encoded certificates to PEM-encoded certificates or shows me the ASN.1 text of a DER-encoded certificate?

Solution 1

Not exactly an "utility", but you can import PEM certificates into Windows Certificate Store and export them back as DER.

In fact, Windows supports PEM-encoded certificates just fine, it just doesn't recognize the .pem extension – you can rename the file to name.crt or name.cer, then you can open it and see all information.

"PEM encoded" means nothing more than Base64-encoded DER, between "begin"/"end" headers. You can use any Base64 decoder for this.

For example, PowerShell has [System.Convert]::FromBase64String($str)...

---

You can also use OpenSSL for Windows:

openssl x509 -in foo.pem -out foo.der -outform der

openssl asn1parse -in foo.pem
openssl asn1parse -in foo.der -inform der

or this online ASN.1 decoder.

Solution 2

You can export to PEM from the Certificate dialog that is built into Windows. The export format is called "Base-64 encoded X.509 (.CER)" and that produces a valid PEM file with a .CER file extension.

Walkthrough:

1. Open any certificate by double-clicking a certificate file in Windows Explorer, inspecting one in your web browser of choice, or from the Certificate Manager Tool (certmgr)
2. Switch to the Details tab of the Certificate dialog
3. Click the Copy to File... button
4. Click Next in the Certificate Export Wizard window
5. Select "Base-64 encoded X.509 (.CER)" on the Export File Form screen, and click Next.
6. Click Browse... or enter a File name, and click Next
7. Click Next and Finish

The extension of the exported file may be .CER but the file format is valid PEM.