Different certificates are stored in different formats (such as whether the public key or private key is encrypted for storage, a single certificate, or multiple certificates), and are encoded differently (der/base64) different standards (such as PEM/PKCS), so although the X.509 standard specifies the certificate content specification, the certificate files are still varied. Fortunately, OpenSSL has good support for these different standards and can be used to convert certificates of different formats.
In general, there are several tasks for certificate conversion.
Encoding and conversion: Der <--> base64
Conversion of different certificate standards: PKCS series <--> PEM/CER
Private Key addition/subtraction/extraction/Conversion
...
PEM--DER/CER (conversion of BASE64--DER encoding)
OpenSSL X509-outform der-in certificate. pem-out certificate. Der
PEM--P7B (PEM--PKCS #7)
OpenSSL crl2pkcs7-nocrl-certfile certificate. cer-out certificate. p7b-certfile cacert. Cer
PEM--PFX #12)
OpenSSL PKCS12-export-out certificate. pfx-inkey privatekey. Key-in certificate. CRT-certfile cacert. CRT
PEM -- p12 (PEM--PKCS #12)
OpenSSL PKCS12-export-out cert. p12-in CERT. pem-inkey key. pem
CER/DER--PEM (Code DER--BASE64)
OpenSSL X509-inform der-in certificate. cer-out certificate. pem
P7B--PEM (PKCS # 7--pem)
OpenSSL pkcs7-print_certs-in certificate. p7b-out certificate. Cer
P7B--PFX (PKCS # 7--pkcs #12)
OpenSSL pkcs7-print_certs-in certificate. p7b-out certificate. Cer
OpenSSL PKCS12-export-in certificate. cer-inkey privatekey. Key-out certificate. pfx-certfile cacert. Cer
Pfx/P12 -- PEM (PKCS # 12--pem)
OpenSSL PKCS12-in certificate. pfx-out certificate. Cer
If you do not need to encrypt the private key in PEM, you can add option-nodes;
If you do not need to export the private key, you can add the option-nokeys;
PEM BASE64--X.509 text format
OpenSSL X509-in key. pem-text-out cert. pem
Extract the private key (. Key) from the pfx file)
OpenSSL PKCS12-In mycert. pfx-nocerts-nodes-out mycert. Key
PEM--SPC
OpenSSL crl2pkcs7-nocrl-certfile Venus. pem-outform der-Out Venus. SPC
PEM--PVK (supported by OpenSSL 1.x)
OpenSSL RSA-In mycert. pem-outform PVK-strong-out mypvk. PVK
PEM--PVK(For versions earlier than OpenSSL 1.x, you can download the PVK converter and run the following command to complete it)
PVK-in CA. Key-out ca. PVK-nocrypt-topvk
PVK format reference: http://www.drh-consultancy.demon.co.uk/pvk.html
For more options and functions of OpenSSL, see the OpenSSL manual.