The tool supports all major formats used in PKI infrastructure:

• PEM (.pem, .crt),
• DER (.cer, .der),
• P7B / PKCS#7 (.p7b),
• PFX / PKCS#12 (.pfx).

Conversion is possible in both directions between PEM, DER, P7B, and PEM ↔ PFX (with password support).

No. PKCS#12 (PFX) always requires a certificate + private key pair. If you try to generate a PFX without providing the key, the tool will return an error because a PFX file cannot be created in an incomplete format.

No. The tool works in stateless mode – all operations take place in RAM during a single PHP session. The contents of keys and certificates are never stored on the server, logged, or written to temporary files, except for standard OpenSSL conversion mechanisms.

The converter uses native PHP OpenSSL functions and – where required – secure OpenSSL commands (e.g., pkcs7, crl2pkcs7).
All operations are based on the standards:

• X.509,
• PKCS#7,
• PKCS#12,
• PEM/DER Base64.

Yes. Certificates must be correctly formatted:

• PEM must include -----BEGIN CERTIFICATE----- / -----END CERTIFICATE-----
• DER must be provided as Base64 (not raw binary),
• PFX must also be provided as Base64.

If the input structure is corrupted, the tool will display an error message.

Yes – converting P7B → PEM automatically generates a single PEM file containing:

• the leaf certificate,
• intermediate certificates,
• the full X.509 chain of trust.

If the P7B contains such a set.

The password secures the PKCS#12 archive, which contains:

• the private key,
• the public certificate,
• intermediate certificates.

A strong password is recommended because PFX is a highly sensitive format (it contains the private key).

Yes. Converting PFX → PEM generates a single PEM file containing:

• the public certificate,
• the RSA/ECDSA private key,
• CA certificates (if included in the PFX bundle).

The file can then be easily separated manually because each section has its own BEGIN/END headers.

Yes. The certificate type (DV/OV/EV) does not affect conversion. The tool operates on the binary X.509 certificate structure, which is identical regardless of the validation level.

The most common errors result from:

• pasting a corrupted PEM (e.g., extra spaces, broken lines, missing headers),
• Base64 corruption before conversion,
• attempting to convert the wrong type (e.g., a key instead of a certificate).

To verify the certificate after conversion:

• use the HEXSSL tool – SSL Decoder,
• or check the structure using: openssl x509 -in cert.pem -text -noout