263

How can I convert .crt to .pem?

Cody Gray
  • 222,280
  • 47
  • 466
  • 543
Ali
  • 9,900
  • 10
  • 53
  • 83

2 Answers2

466

You can do this conversion with the OpenSSL library. Windows binaries can be found here.

Once you have the library installed, the command you need to issue is:

openssl x509 -in mycert.crt -out mycert.pem -outform PEM
2240
  • 1,368
  • 1
  • 6
  • 18
MrEyes
  • 11,483
  • 9
  • 44
  • 66
  • 61
    @Dave, this is generally equivalent to `cp mycert.crt mycert.pem`. Since the default `-inform` is `PEM`, this is just doing an in->out conversion from PEM to PEM. The main different might be in potential text headers around the actual cert. Most of the time `.crt` are in PEM format anyway, but sometimes they're in DER format (the conventions are not always well established). – Bruno Jul 03 '14 at 11:33
  • 49
    I had to use the line "openssl x509 -in myCert.crt -inform der -outform pem -out myCert.pem" to get it interpreted correctly. – Andreas Rudolph Dec 10 '14 at 14:01
  • 1
    Didn't work for me, the certificate apparently needs to contain intermediate certificates. – alexfernandez Nov 18 '15 at 10:43
  • 15
    I am at loss why so misleading answer has so many up votes. "crt" is just a part of file name and has nothing to do with format, which may be DER or PEM. Only if you know the format, you can use above mentioned command with proper options. – wst Jun 03 '16 at 00:25
  • 2
    The above command has just generated a .pem with the same content as the .crt file. So, I think Dave is right.. could have just copy pasted the file with .pem extension at list in my case! – Raptor Oct 08 '16 at 05:29
  • 4
    .crt files may already be in PEM format (in which case the answer above will work, or a simple copy which does the exact same thing). Or, they may be in DER format, in which case the above answer won't work, and you need to add `-inform DER` as other comments and answers have noted. – Erica Kane Oct 20 '17 at 12:54
  • not working for me. Getting: unable to load certificate 4724020844:error:09FFF06C:PEM routines:CRYPTO_internal:no start line:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.240.1/libressl-2.6/crypto/pem/pem_lib.c:683:Expecting: TRUSTED CERTIFICATE. solution below by Anil G worked though – ng10 Mar 04 '19 at 22:17
208

I found the OpenSSL answer given above didn't work for me, but the following did, working with a CRT file sourced from windows.

openssl x509 -inform DER -in yourdownloaded.crt -out outcert.pem -text
hagrawal
  • 12,025
  • 4
  • 33
  • 61
NeilG
  • 3,036
  • 2
  • 18
  • 20
  • 2
    Worked perfect, thanks. Seems some crt files are binary (DER) encoded and others are base64 encoded like pem. – Brad Hein Jul 06 '18 at 12:04
  • worked like charm, thank you! solution above did not work, see my comment there on details. using Mac OS – ng10 Mar 04 '19 at 22:18
  • 3
    This should be the accepted answer. – Thomas Keller Sep 09 '19 at 11:00
  • I had a situation where I needed to convert several files. Used a loop in Bash with parameter expansion to create the `.pem` extension from each original file name. `for f in *.crt ; do openssl x509 -in "$f" -outform PEM -out "${f%.*}.pem" ; done` It will transform, for example, `file1.crt`, `file2.crt` to `file1.pem` and `file2.pem`. – Fernando Basso Mar 13 '20 at 12:33
  • Saved me, thank you! – Ben Throop Dec 02 '20 at 21:45