Converting certificates between PEM, DER and PKCS#12 with openssl for cross-platform trust and keystores

Goal

Move one certificate (and, when needed, its private key) between the PEM, DER and PKCS#12 formats so it can be installed into a Linux anchors directory, a Windows/macOS store expecting .cer/.p12, or a Java keystore, using OpenSSL 1.1.1 or later (command syntax shown is stable through OpenSSL 3.x).

Prerequisites

openssl on the machine doing the conversion; the source certificate and, for PKCS#12 operations involving a key, the matching private key and its passphrase if encrypted.

Steps

1. Inspect what you have first: openssl x509 -in cert.pem -noout -text prints the parsed certificate (issuer, subject, validity, SANs) so you know it is actually a certificate and not a bundle or a key before converting it.
2. DER to PEM (Windows .cer is often DER-encoded, and PEM is what Linux anchors directories expect): openssl x509 -inform der -in cert.cer -out cert.pem -outform pem.
3. PEM to DER, when a tool insists on the binary form: openssl x509 -in cert.pem -outform der -out cert.der.
4. Extract a certificate and private key out of a PKCS#12 bundle (a .pfx/.p12 handed to you for a service that needs separate PEM files): openssl pkcs12 -in bundle.p12 -clcerts -nokeys -out cert.pem for the certificate, and openssl pkcs12 -in bundle.p12 -nocerts -out key.pem for the key; both prompt for the bundle's import password unless -passin is given for non-interactive use. The extracted key is re-encrypted with a new PEM passphrase unless you add -noenc (OpenSSL 3; -nodes in 1.1.1, deprecated but still accepted in 3.x).
5. Build a PKCS#12 bundle from separate PEM files, for import into Windows or a Java keystore: openssl pkcs12 -export -in cert.pem -inkey key.pem -certfile chain.pem -out bundle.p12 -name "myservice"; add -passout to avoid an interactive password prompt in scripts. OpenSSL 3 encrypts the bundle with AES-256-CBC/PBKDF2 and a SHA-256 MAC by default, which older importers (older Windows releases, old Java) may reject; add -legacy (3DES-based) for those.

Expected result

openssl pkcs12 -in bundle.p12 -info -noout lists the certificate and key entries it contains without extracting them, confirming the bundle is well-formed. openssl x509 -in cert.pem -noout -subject -issuer on a converted file should show the same subject and issuer as the original, confirming no data was lost in conversion.

Limits and test basis

Converting formats never changes what a certificate says or how long it is valid; it only re-encodes the same content. OpenSSL 3 refuses to read PKCS#12 files protected with legacy algorithms such as RC2-40-CBC (common in older Windows exports and OpenSSL 1.x output) with an "unsupported" error; -legacy loads the legacy provider, which some distributions package separately. A password given on the command line with -passin pass:/-passout pass: is visible in shell history and process listings — prefer -passout file:/path (readable only by the invoking user) for anything beyond a throwaway test file, and delete plaintext intermediate key.pem files after use.