In the digital world, SSL certificates are an indispensable part of any secure internet connection. Whether for websites, web applications, email servers or internal corporate systems, SSL/TLS ensures encryption, integrity and authenticity. However, confusion often arises when dealing with certificates, particularly regarding the various file formats.
What does each file extension mean? How do .pem, .pfx and .p7b differ? And which format is required in which system environment? In this article, we provide a comprehensive answer to precisely these questions - including practical conversion tools.
What exactly is an SSL certificate?
An SSL certificate (Secure Sockets Layer, or nowadays: TLS - Transport Layer Security) is used to encrypt the connection between a client (e.g. a browser) and a server (e.g. a web server). At the same time, it guarantees that the server is who it claims to be - and that no third parties can tamper with the connection.
A certificate consists of:
- The public key
- Information on the holder, validity and issuer
- Signature of the issuing certification authority (CA)
- Optional: intermediate certificates and root certificates for the chain of trust
However, all this data must be stored in a suitable format - and this is where choosing the right file format is crucial.
An overview of the most important SSL certificate formats
There are several established standards that are used in different systems and use cases. Essentially, these are:
1. PEM (.pem / .crt / .cer / .key)
The Privacy Enhanced Mail (PEM) format is one of the most widely used SSL formats. It is mainly used in Unix and Linux environments (Apache, NGINX, Postfix, Dovecot, etc.). It is Base64-encoded and usually accompanied by a -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- .
PEM files may contain:
- A single certificate (public key)
- The private key
- The entire certificate chain (CA certificates)
Important: Many hosting providers require the PEM format for manual certificate installations.
Convert
PEM to PKCS#12 (.pfx)
Convert
PEM to PKCS#7 (.p7b)
Convert PEM to DER format
2. PKCS#12 (.pfx / .p12)
The Public-Key Cryptography Standards #12 (PKCS#12) format - also known as PFX - is particularly popular in Windows environments, such as Microsoft Exchange, IIS or Outlook. Unlike PEM, PKCS#12 can bundle multiple items into a single file:
- Certificate
- Intermediate certificates / certificate chain
- Private key
- Optional: passwords for security
The format is binary-encoded, not directly readable, but universally applicable - particularly when the certificate, together with the key and CA bundle, is to be imported onto a system.
Note: Some applications - e.g. Java keystores - sometimes require the components to be explicitly separated (e.g. using OpenSSL), which is easily done with PFX.
3. PKCS#7 (.p7b / .p7c)
This format is also an official cryptographic standard and is commonly used in Java environments (Tomcat, JBoss, etc.) as well as in certain Microsoft products. PKCS#7 stores only the certificate chain, but not the private key.
It is encoded either in Base64 (p7b) or in binary (p7c) and is well suited when the key is already present separately within the system. It is typically used in conjunction with a Java KeyStore or Microsoft MMC.
Why do you need to convert SSL certificates?
Not every platform supports the same formats. Whilst Apache uses a .crt and .key , a Windows server prefers .pfx, whilst Tomcat .p7b. Many CAs issue their certificates in PEM format - which often leads to compatibility issues.
The conversion is not technically difficult - provided you know the right tools and steps. OpenSSL is usually used. We have provided our own step-by-step guides for common scenarios:
Tools and resources for conversion
For converting SSL certificates, we recommend:
- OpenSSL: The open-source standard for command-line cryptography
- Windows Certificate Store (MMC): For easy import/export of PFX files
- KeyTool (Java): For importing P7B files into JKS/PKCS12
- SpeedIT online knowledge base: Featuring specific commands and real-world examples
Common causes of errors when integrating certificates
Even with high-quality certificates, integration can fail - often due to an incorrect format or missing components:
- Private key missing: Some CAs only issue the public certificate. The private key is stored locally - this must never be disclosed.
- CA bundle not imported: Without intermediate certificates, some browsers do not recognise the certificate as valid.
- Incorrect format selected: e.g. .pfx on Apache or .pem on Microsoft - this leads to read errors.
- Incorrect conversion: PFX files created incorrectly may be incompatible or cause crashes.
Security when handling SSL files
An SSL certificate is public - but the private key must be strictly protected. Please note:
- Never send it unencrypted via email
- Do not store them in shared cloud directories
- Only back up in encrypted form using a strong password
- Restrict access rights on the server (chmod 600)
PFX files should always be protected with a secure password when exported. This provides additional security and prevents unauthorised import onto other systems.
Conclusion: Choosing the right SSL certificate format is crucial
Anyone who works closely with servers, web hosting or corporate IT will, sooner or later, come into contact with SSL certificates. Choosing the right format often determines whether integration is successful or results in hours of debugging.
Thanks to our guides and conversion articles, you’ll be well prepared to meet any requirement securely. Should you still have any questions, our team will be happy to advise you - personally, competently and in compliance with the GDPR.
Find out more about our SSL products now or get in touch directly.
Single Domain SSL WildCard SSL
