What order should a certificate chain be in?

Leaf certificate first, then each intermediate in ascending order toward the root. The root itself is normally omitted — clients already trust it. Out-of-order chains are a leading cause of handshake failures on stricter clients.

How do I convert between these formats?

openssl handles all of them: openssl x509 -inform der -outform pem for DER to PEM, openssl pkcs12 -in file.pfx -nodes for extracting a PKCS#12. This decoder tells you which conversion you actually need.

Can this open a password-protected .pfx?

No. PKCS#12 files are encrypted, and they contain a private key — decrypt them locally with openssl rather than pasting them into any web tool.

PEM / DER / PKCS Decoder

Split and inspect PEM, DER, PKCS#7 and PKCS#12 certificate bundles.

on the roadmapSecurity, PKI & Cryptofree · no sign-up

This bench is being wired up

The pem-der-decoder decoder is on the roadmap. The heavier binary and cryptographic parsers ship after the core text and token decoders — all of which are already live and working.

Browse the live decoders

Input is processed on your device. Nothing you paste is sent anywhere.

What is the PEM / DER / PKCS Decoder?

A PEM/DER decoder identifies and separates the individual objects inside a certificate file — certificates, keys, chains and PKCS containers — so you can see exactly what a bundle holds and in what order.

Certificate files are a nest of overlapping formats. PEM is Base64 with BEGIN/END labels and may hold several concatenated objects. DER is the raw binary underneath. PKCS#7 (.p7b) bundles certificates without keys. PKCS#12 (.pfx/.p12) bundles a certificate, its chain and the private key together, encrypted with a password. The file extension tells you very little; the content tells you everything.

Most 'certificate installation failed' tickets are a format or ordering problem rather than a cryptographic one: a PKCS#7 uploaded where PEM was expected, a chain concatenated in the wrong order, an intermediate missing, or a key that doesn't match the certificate. Splitting the file and identifying each block is how you find out which one it is.

PEM / DER / PKCS Decoder at a glance

PEM: Base64 + BEGIN/END labels · may hold many objects
DER: Raw binary ASN.1 · one object per file
PKCS#7 (.p7b): Certificate bundle, no private key
PKCS#12 (.pfx): Certificate + chain + key, password-encrypted

How to use the PEM / DER / PKCS Decoder

1Paste the file contents, however many BEGIN blocks it contains.
2Each object is identified by type and listed in the order it appears.
3Reorder the chain leaf-first, or extract the single block you actually needed.

When you would reach for it

Working out what a mystery .crt, .pem or .p7b file actually holds.
Fixing chain order for a server that rejects the bundle you were given.
Separating a full-chain PEM into leaf and intermediates for a device that wants them apart.

PEM / DER / PKCS Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools