Certificate authorities, Windows servers and control panels do not all use the same file type. To move a certificate from IIS to cPanel, or from a CA download to a Windows server, you need to convert SSL certificate formats. OpenSSL does all of it with one command per conversion.
Before you start
- OpenSSL installed: it is built into Linux and macOS, and included with Git for Windows. On MdmHost hosting you can run it in cPanel → Advanced → Terminal if Terminal is enabled for your account.
- The certificate, its private key and the CA bundle (intermediate certificates).
SSL certificate formats explained
| Format | Extensions | Encoding | Contains | Used by |
|---|---|---|---|---|
| PEM | .pem, .crt, .cer, .key | Base64 text with -----BEGIN lines | Certificate, key or chain | cPanel, Apache, Nginx, LiteSpeed |
| DER | .der, .cer | Binary | One certificate | Java, some appliances |
| PKCS#12 | .pfx, .p12 | Binary, password protected | Certificate, key and chain together | Windows IIS, Exchange |
| PKCS#7 | .p7b, .p7c | Base64 or binary | Certificates and chain, no key | Windows, Java Tomcat |
How to identify a certificate file
Open it in a text editor. If you see -----BEGIN CERTIFICATE----- it is PEM. Unreadable binary is DER or PFX. You can also inspect it:
openssl x509 -in certificate.crt -text -nooutConvert PFX to PEM (for cPanel)
Extract the certificate and chain, then the private key:
openssl pkcs12 -in site.pfx -clcerts -nokeys -out certificate.crtopenssl pkcs12 -in site.pfx -cacerts -nokeys -out ca-bundle.crtopenssl pkcs12 -in site.pfx -nocerts -nodes -out private.keyYou will be asked for the PFX password. With OpenSSL 3 and an old PFX file, add -legacy if you get an unsupported algorithm error.
Convert PEM to PFX (for Windows)
openssl pkcs12 -export -out site.pfx -inkey private.key -in certificate.crt -certfile ca-bundle.crtChoose a strong export password; you need it when importing into Windows.
Convert DER and PEM
openssl x509 -inform der -in certificate.der -out certificate.pemopenssl x509 -outform der -in certificate.pem -out certificate.derConvert P7B to PEM
openssl pkcs7 -print_certs -in certificate.p7b -out certificate.pemThe output contains the server certificate and the intermediates; split them into the certificate and CA bundle fields.
Check that the key matches the certificate
Both commands must print the same hash:
openssl x509 -noout -modulus -in certificate.crt | openssl md5openssl rsa -noout -modulus -in private.key | openssl md5For ECDSA keys, compare the public keys instead with openssl pkey -pubout and openssl x509 -pubkey -noout.
Install the converted files in cPanel
- Go to cPanel → Security → SSL/TLS → Manage SSL sites.
- Paste the certificate (CRT), private key (KEY) and CA bundle into their boxes.
- Click Install Certificate.
Important: A private key extracted with -nodes is unencrypted. Never email it or leave it in a public folder; delete local copies once installed.
Troubleshooting
- Mac verify error: invalid password: wrong PFX password, or an older file that needs
-legacy. - Key does not match certificate: the key belongs to a different CSR. Find the matching key or reissue the certificate.
- Chain incomplete after install: the CA bundle was missing. Add the intermediates.
Frequently asked questions
Are .crt and .pem different?
Usually not. Both are often PEM text; the extension is just a naming habit.
Does converting change the certificate?
No. Only the container and encoding change. The certificate and key stay identical.
Can I convert a certificate without its private key into PFX?
No. A PFX for a server needs the private key that matches the certificate.