---
title: "Streamlining Security: Converting CRT Certificates to PEM"
description: "Dive in and learn how to use and to convert CRT certificates to PEM via PowerShell scripts in this ATA Learning tutorial!"
canonical: "https://adamtheautomator.com/crt-certificates-to-pem/"
---

# Streamlining Security: Converting CRT Certificates to PEM

> Dive in and learn how to use and to convert CRT certificates to PEM via PowerShell scripts in this ATA Learning tutorial!

Source: https://adamtheautomator.com/crt-certificates-to-pem/

---

ATA Learning

Tap to hide

[

ATA Learning

](/)

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Search for:  

*   [](https://twitter.com/adbertram)
*   [](https://github.com/Adam-the-Automator)
*   [](https://www.linkedin.com/company/adam-the-automator-llc)
*   [](/feed/)

![Streamlining Security: Converting CRT Certificates to PEM](https://adamtheautomator.com/wp-content/uploads/2023/11/crt-certificates-to-pem.jpg)

# Streamlining Security: Converting CRT Certificates to PEM

[![](https://secure.gravatar.com/avatar/3af64110e538c07a01fd9f0782f700ce6ed2d798bbf7b120e299d375eca5b0b3?s=192&d=mm&r=g)Arman Castillote](https://adamtheautomator.com/author/arman-castillote/)20 November 20238 min. read

Categories: [IT Ops](/category/it-ops/)

Tags:[Certificates](/tag/certificates/)

Table of Contents

*   [Prerequisites](#prerequisites)
*   [Changing File Extensions of Base64 CRT Certificates to PEM](#changing-file-extensions-of-base64-crt-certificates-to-pem)
*   [Converting CRT Certificates to PEM via Certificate Export Wizard](#converting-crt-certificates-to-pem-via-certificate-export-wizard)
*   [Harnessing OpenSSL: Cross-Platform Certificates Conversion](#harnessing-openssl-cross-platform-certificates-conversion)
*   [Enforcing PowerShell to Convert Binary (DER) Certificates to PEM](#enforcing-powershell-to-convert-binary-der-certificates-to-pem)
*   [Integrating Converted PEM Certificate with NGINX](#integrating-converted-pem-certificate-with-nginx)
*   [Conclusion](#conclusion)

Imagine having the ideal SSL certificate for your application, but unfortunately, not all applications raise their hands in acceptance. If you’re left staring at a compatibility roadblock, why not convert CRT certificates to PEM?

In this tutorial, you’ll unravel the mystery of converting CRT certificates to PEM, ensuring your security measures seamlessly fit into any application.

Never let SSL formats keep you up at night ever again. Navigate through the nuances of certificate compatibility!

## Prerequisites

Ensure you have the following in place, as they are essential in seamlessly following along with this tutorial:

*   A machine that supports OpenSSL and NGINX – This tutorial uses Windows 10 Pro 22H2.
*   An [NGINX Server](https://www.nginx.com/resources/wiki/start/topics/tutorials/install/#official-win32-binaries) setup – This tutorial has NGINX installed in a root folder (_C:\\nginx_).
*   OpenSSL installed.

Related:[OpenSSL on Windows 10: A Comprehensive PowerShell Guide](https://adamtheautomator.com/openssl-windows-10/)

*   One [Base64-Encoded CRT](https://knowledge.digicert.com/general-information/what-does-base-64-mean) (i.e., _myBase64CRT.crt_) and one [DER-Encoded CRT](https://docs.fileformat.com/web/der/) (i.e., _myDERCRT.crt_) with a private key (i.e., _myDERCRT.key_).

Related:[New-SelfSignedCertificate: Creating Certificates with PowerShell](https://adamtheautomator.com/new-selfsignedcertificate/)

## Changing File Extensions of Base64 CRT Certificates to PEM

In your quest to streamline security by converting CRT certificates to PEM, the first task entails renaming Base64 CRT certificates. But this tutorial is about conversions, so why change file extensions?

Base64 CRT and PEM certificates are already in the same format; both consist of ASCII characters that you can open in any text editor. Thus, changing file extensions of your Base64 CRT certificates to PEM will suffice — no conversion is required.

To change file extensions of Base64-encoded CRT Certificates to PEM, follow these steps:

1\. Rename your certificate to change its file extension from _.crt_ to _.pem_, as shown below.

![Changing file extensions of Base64-encoded CRT certificates to PEM](https://adamtheautomator.com/wp-content/uploads/2023/11/image-107.png)

Changing file extensions of Base64-encoded CRT certificates to PEM

2\. When prompted, click **Yes** to confirm the file extension change.

![Confirming the file extension change](https://adamtheautomator.com/wp-content/uploads/2023/11/image-106.png)

Confirming the file extension change

Notice that the file’s icon differs, and the file type changed from Security Certificate to **PEM File**.

![Verifying the successful change of file extension](https://adamtheautomator.com/wp-content/uploads/2023/11/image-105.png)

Verifying the successful change of file extension

3\. Open your PEM certificate in your preferred text editor, and you’ll see that the file extension change did not affect the certificate’s content.

![Verifying the new PEM certificate’s content](https://adamtheautomator.com/wp-content/uploads/2023/11/image-104.png)

Verifying the new PEM certificate’s content

## Converting CRT Certificates to PEM via Certificate Export Wizard

In contrast to Base64-encoded certificates, the DER-encoded CRT file is in binary format. While you can open a DER-encoded certificate in a text editor, the content appears as unintelligible characters, as shown below, making it challenging to interpret.

![Viewing the DER-encoded certificate’s content](https://adamtheautomator.com/wp-content/uploads/2023/11/image-117.png)

Viewing the DER-encoded certificate’s content

To convert CRT certificates to PEM format via the Certificate Export Wizard, you’ll export the certificate as Base63-encoded first, as follows:

1\. Open the Run dialog (Win+R), input _**certmgr.msc**_, and click **OK** (or press Enter) to open the Certificate Manager.

![Opening the Certificate Manager](https://adamtheautomator.com/wp-content/uploads/2023/11/image-116.png)

Opening the Certificate Manager

2\. Next, expand **Personal** (left pane), choose **Certificates**, locate, and right-click on your DER certificate → **All Tasks** → **Export**.

The Certificate Export Wizard appears, where you can choose options for exporting your DER certificate (step three).

![Initiating exporting a DER certificate](https://adamtheautomator.com/wp-content/uploads/2023/11/image-115.png)

Initiating exporting a DER certificate

3\. On the welcome page, click **Next** to continue.

![Continuing with exporting certificates](https://adamtheautomator.com/wp-content/uploads/2023/11/image-114.png)

Continuing with exporting certificates

4\. Now, choose which option best suits your needs.

But for this tutorial, choose not to export the private key and click **Next** to continue.

![Choosing not to export the private key](https://adamtheautomator.com/wp-content/uploads/2023/11/image-113.png)

Choosing not to export the private key

5\. For the file format, choose the second option since you’re exporting your DER certificate as a **Base64-encoded** one (**.CER**) and click **Next**.

![Selecting the Base64-encoded format](https://adamtheautomator.com/wp-content/uploads/2023/11/image-112.png)

Selecting the Base64-encoded format

6\. Browse your preferred location to export the Base64-encoded certificate, and click **Next** to confirm.

![Browsing a location to export the Base64-encoded certificate](https://adamtheautomator.com/wp-content/uploads/2023/11/image-111.png)

Browsing a location to export the Base64-encoded certificate

7\. Subsequently, review your selected settings and click **Finish** to complete exporting your Base64-encoded certificate.

![Finalizing exporting the Base64-encoded certificate](https://adamtheautomator.com/wp-content/uploads/2023/11/image-110.png)

Finalizing exporting the Base64-encoded certificate

8\. Look for the exported Base64-encoded certificate and change its file extension from _.cer_ to _.pem_.

![Changing the .cer file extension to .pem](https://adamtheautomator.com/wp-content/uploads/2023/11/image-109.png)

Changing the _.cer_ file extension to _.pem_

9\. Lastly, open your new PEM certificate in a text editor, and you’ll see the data is now in ASCII characters.

![Verifying the content of the exported and converted certificate to PEM](https://adamtheautomator.com/wp-content/uploads/2023/11/image-108.png)

Verifying the content of the exported and converted certificate to PEM

## Harnessing OpenSSL: Cross-Platform Certificates Conversion

While the Certificate Export Wizard works well at converting certificates, the drawback lies in the tedious nature of the process. But why waste time in a step-by-step approach when you can accomplish the same outcome with a single command?

For those inclined towards command-line interfaces (CLIs), OpenSSL emerges as a solution for efficient and seamless certificate management. Adding to its appeal, OpenSSL is cross-platform, enabling users to manage certificates seamlessly across Windows and Linux systems.

To harness OpenSSL in converting certificates to PEM, complete the steps below:

1\. Open PowerShell (as administrator) or terminal in your system, and change the directory to where your DER-encoded certificate lies.

Related:[Run PowerShell as Administrator: Multiple Methods Explored](https://adamtheautomator.com/powershell-run-as-administrator/)

2\. Next, execute the following `openssl` command (which has no output) whether you’re in a Windows or Linux system.

This command converts your DER-encoded certificate (i.e., `myDERCRT.crt`) to PEM (`-outform`) named `myDERCRT.pem` (arbitrary).

```powershell
openssl x509 -inform der -in myDERCRT.crt -outform pem -out myDERCRT.pem
```

Related:[Your Guide to X509 Certificates (For Mortals)](https://adamtheautomator.com/x509-certificates/)

3\. Lastly, verify the data in the certificate are now in ASCII characters, as shown below.

![Verifying the converted DER certificate to PEM](https://adamtheautomator.com/wp-content/uploads/2023/11/image-118.png)

Verifying the converted DER certificate to PEM

## Enforcing PowerShell to Convert Binary (DER) Certificates to PEM

Much like the versatile OpenSSL toolkit, PowerShell is another force that emerges to be reckoned with in scripting and automation. Dealing with a bunch of certificates every day can be a bit much. Right there in the mix, PowerShell comes in handy.

PowerShell lets you create cool and reusable functions to automate the tedious, repetitive stuff. With PowerShell functions, you can handle diverse certificates without breaking a sweat.

To convert binary certificates to PEM, proceed with the following:

1\. Create a PowerShell script called _ConvertDERtoPEM.ps1_ (arbitrary) in your editor, like Visual Studio Code (VSCode), add the following code, and save the file.

Related:[The Visual Studio Code Tutorial Worth Learning](https://adamtheautomator.com/visual-studio-code-tutorial/)

This code uses a `function` that asks a user to provide the name of the DER certificate and convert it to a Base64-encoded PEM certificate.

```powershell
function ConvertDERtoBase64PEM {
    param (
        [string]$certificateName
    )
	# Test if the certificate file exist
    if (-not (Test-Path $certificateName -PathType Leaf)) {
        Write-Host "Error: Certificate file not found."
        return
    }

    # Check if OpenSSL is installed by checking the PATH for openssl executable
    $opensslPath = Get-Command openssl -ErrorAction SilentlyContinue

	# If not, display a message
    if (-not $opensslPath) {
        Write-Host "Error: OpenSSL is not found in the PATH. Please ensure OpenSSL is installed and try again."
        return
    }

    # Determine the output filename without the original extension
    $outputFile = [System.IO.Path]::ChangeExtension($certificateName, "pem")

    # Convert DER to Base64-encoded PEM using OpenSSL
    & openssl x509 -inform der -in $certificateName -outform pem -out $outputFile

	# Display message of successful conversion
    Write-Host "Conversion completed. The Base64-encoded PEM certificate has been saved: `n$((Resolve-Path $outputFile).Path)"
}

# MAIN SCRIPT ====================

# Prompt user for certificate name
$certificateName = Read-Host "Name or full path of the DER-encoded certificate file to convert (include extension):"

# Call the conversion function
ConvertDERtoBase64PEM -certificateName $certificateName
```

Related:[Mastering PowerShell Functions: A Step-by-Step Guide](https://adamtheautomator.com/powershell-functions/)

2\. Next, open PowerShell as administrator, change the directory to where your certificate is located and execute the following to run your script (_`ConvertDERtoPEM.ps1`_).

```powershell
./ConvertDERtoPEM.ps1
```

Related:[How to Run a PowerShell Script From the Command Line and More](https://adamtheautomator.com/run-powershell-script/)

Provide the name of your DER-encoded certificate, including the file extension (i.e., _**myDERCRT.crt**_).

![Converting a DER-encoded certificate to PEM via PowerShell](https://adamtheautomator.com/wp-content/uploads/2023/11/image-120.png)

Converting a DER-encoded certificate to PEM via PowerShell

3\. Now, open the converted file in your text editor to verify the data is now in ASCII characters.

![Verifying the converted DER certificate to PEM](https://adamtheautomator.com/wp-content/uploads/2023/11/image-118.png)

Verifying the converted DER certificate to PEM

## Integrating Converted PEM Certificate with NGINX

Regardless of which method you used to convert your certificate to PEM format, the critical question is: Does it seamlessly integrate with NGINX? You must configure NGINX to listen to the HTTPS port and point to where your certificate and key file are located.

Related:[Activating NGINX to Redirect HTTP to HTTPS Traffic](https://adamtheautomator.com/nginx-to-redirect-http-to-https/)

To test your converted PEM certificate with NGINX, complete the steps below:

1\. Open PowerShell as admin, navigate to _C:\\nginx_ where you installed NGINX and execute the following, which has no output but runs NGINX as a service.

```powershell
.\nginx.exe
```

2\. Next, open your favorite web browser and visit _[http://localhost](http://localhost)_, which redirects your browser to NGINX’s welcome page, as shown below. But, currently, you can only access the localhost through HTTP (not HTTPS), a situation you’ll address in the next step.

![Accessing the localhost (via http) using the NGINX service](https://adamtheautomator.com/wp-content/uploads/2023/11/image-124.png)

Accessing the localhost (via http) using the NGINX service

3\. Subsequently, run the following `New-Item` command, which has no output but creates a new folder (`Directory`) called `C:\nginx\conf\ssl`.

```powershell
New-Item -ItemType Directory -Path C:\nginx\conf\ssl
```

Related:[A Beginners Guide To PowerShell New-Item](https://adamtheautomator.com/powershell-new-item/)

4\. Now, execute the `Move-Item` command below to move your PEM certificate (`myDERCRT.pem`) and key (`myDERCRT.key`) to the _`C:\nginx\conf\ssl`_ folder.

This command produces no output, but ensure you specify the path of the certificate and key files.

```powershell
Move-Item -Path "cert_path", "key_path" -Destination "C:\nginx\conf\ssl"
```

Related:[owerShell Move File in Action with Move-Item](https://adamtheautomator.com/powershell-move-file/)

5\. Open the NGINX configuration file (_C:\\nginx\\conf\\nginx.conf_) in your text editor, and add the configuration below inside the server block.

Ensure you replace _`cert.pem`_ and `cert.key` with your certificate’s and key’s actual name, save the changes, and close the editor.

```
# Listen on port 443 with SSL support
listen 443 ssl;

# Listen on IPv6 address on port 443 with SSL support
listen [::]:443 ssl;

# Specify the SSL certificate file path
ssl_certificate ssl/cert.pem;

# Specify the SSL certificate key file path
ssl_certificate_key ssl/crt.key;

# Specify the supported SSL/TLS protocols
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
```

![Configuring NGINX to listen to the HTTPS port (443)](https://adamtheautomator.com/wp-content/uploads/2023/11/image-123.png)

Configuring NGINX to listen to the HTTPS port (443)

6\. Switch back to PowerShell, and run the following command inside the root folder where you installed NGINX (_C:\\nginx_).

This command doesn’t provide output to the console but lets you `reload` the NGINX service.

```powershell
nginx -s reload
```

7\. Once NGINX reloads, close and re-open your browser, and navigate to [](https://localhost)_[https://localhost](https://localhost)_ in your browser to test your PEM certificate.

You’ll see a warning about an invalid certificate since you’re using a self-signed certificate. But don’t panic. Jump to the following step to trust your PEM certificate.

![ Accessing the localhost via HTTPS using NGINX](https://adamtheautomator.com/wp-content/uploads/2023/11/image-122.png)

Accessing the localhost via HTTPS using NGINX

8\. Switch back to PowerShell and run these commands, which produce no output, make your PEM certificate a trusted one.

> 💡 _You can also turn this into a reusable PowerShell function by creating a script (i.e., [TrustCertificate.ps1](https://gist.github.com/acast15/1d5bf9c784cb5c4576bb90f23f9c92a2)). You can even call it in your [PowerShell profile](https://adamtheautomator.com/powershell-profile-a-getting-started-guide/) by adding the full path to your script as follows:_  
> _`. “/path/to/TrustCertificate.ps1”`_

```powershell
# Specify the path to your PEM certificate
$certificatePath = "C:\\nginx\\conf\\ssl\\cert.pem"

# Create a new X.509 certificate object
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2

# Import the certificate from the specified path
$cert.Import($certificatePath)

# Create a new X.509 store for Trusted Root Certification Authorities on the Local Machine
$store = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", "LocalMachine")

# Open the store, add the certificate to the store, and close the store
$store.Open("ReadWrite"); $store.Add($cert); $store.Close()
```

9\. Afterward, execute the following command to `reload` the NGINX server again.

```powershell
nginx -s reload
```

10\. Finally, refresh the [](https://localhost)_[https://localhost](https://localhost)_ page to test your newly-trusted PEM certificate.

If everything proceeds as expected, the NGINX welcome page reloads in your browser, and this time, the address bar no longer displays “Not secure.”

This result confirms that your converted PEM certificate effectively secures your connection as intended.

![Verifying the converted PEM certificate works](https://adamtheautomator.com/wp-content/uploads/2023/11/image-121.png)

Verifying the converted PEM certificate works

## Conclusion

Throughout this journey, you’ve acquired a versatile skill set in certificate management. You explored various methods to convert CRT certificates to PEM from the foundational step of changing file extensions. These methods include employing the Certificate Export Wizard, leveraging the flexibility of OpenSSL, and orchestrating conversions through PowerShell scripting.

The pinnacle of this journey was reached as you seamlessly integrated your converted PEM certificate with NGINX, ensuring the secure transmission of data.

Now, consider elevating your expertise further as you reflect on these accomplishments. Why not delve into more advanced certificate management? Explore diverse tools and platforms, or even contribute your insights to the community!

Related:[Windows Certificate Management with PowerShell](https://adamtheautomator.com/windows-certificate-manager/)

Share this article

[Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fcrt-certificates-to-pem%2F&text=Streamlining%20Security%3A%20Converting%20CRT%20Certificates%20to%20PEM)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fcrt-certificates-to-pem%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fcrt-certificates-to-pem%2F)

## Related Posts

![](https://adamtheautomator.com/wp-content/uploads/2026/04/featured_image-6.webp)

### [How to Survive the 2026 Secure Boot Certificate Expiry](/survive-2026-secure-boot-certificate-expiry-3/)

Deploy Windows UEFI CA 2023 before the June 2026 certificate expiry. Inventory devices, update OEM firmware, and trigger enrollment via Intune or PowerShell registry settings.

![](https://adamtheautomator.com/wp-content/uploads/2026/04/featured_image-6.webp)

### [How to Survive the 2026 Secure Boot Certificate Expiry](/survive-2026-secure-boot-certificate-expiry/)

Deploy Windows UEFI CA 2023 before the June 2026 certificate expiry. Inventory devices, update OEM firmware, and trigger enrollment via Intune or PowerShell registry settings.

![](https://adamtheautomator.com/wp-content/uploads/2019/11/letter-576461_1280.png)

### [Understanding X509 Certificates: A Clear and Concise Guide (For Mortals)](/x509-certificates/)

Discover the essentials of X509 Certificates: Understand key exchanges, certificate signing, and more in this comprehensive yet straightforward guide.

## Categories

*   [IT Ops](/category/it-ops/)
*   [Cloud](/category/cloud/)
*   [DevOps](/category/devops/)
*   [Home Ops](/category/home-ops/)
*   [Information Security](/category/infosec/)
*   [Software Development](/category/software-development/)

## Site

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)