Use OpenSSL for Certificate Format Conversion

Different certificates are stored in different formats (such as whether the public key or private key is encrypted for storage, a single certificate, or multiple certificates), and are encoded differently (der/base64) different standards (such as PEM/PKCS), so although the X.509 standard specifies the certificate content specification, the certificate files are still varied. Fortunately, OpenSSL has good support for these different standards and can be used to convert certificates of different formats.

In general, there are several tasks for certificate conversion.

Encoding and conversion: Der <--> base64
Conversion of different certificate standards: PKCS series <--> PEM/CER
Private Key addition/subtraction/extraction/Conversion
...

PEM--DER/CER (conversion of BASE64--DER encoding)

OpenSSL X509-outform der-in certificate. pem-out certificate. Der

PEM--P7B (PEM--PKCS #7)

OpenSSL crl2pkcs7-nocrl-certfile certificate. cer-out certificate. p7b-certfile cacert. Cer

PEM--PFX #12)

OpenSSL PKCS12-export-out certificate. pfx-inkey privatekey. Key-in certificate. CRT-certfile cacert. CRT

PEM -- p12 (PEM--PKCS #12)

OpenSSL PKCS12-export-out cert. p12-in CERT. pem-inkey key. pem

CER/DER--PEM (Code DER--BASE64)

OpenSSL X509-inform der-in certificate. cer-out certificate. pem

P7B--PEM (PKCS # 7--pem)

OpenSSL pkcs7-print_certs-in certificate. p7b-out certificate. Cer

P7B--PFX (PKCS # 7--pkcs #12)

OpenSSL pkcs7-print_certs-in certificate. p7b-out certificate. Cer
OpenSSL PKCS12-export-in certificate. cer-inkey privatekey. Key-out certificate. pfx-certfile cacert. Cer

Pfx/P12 -- PEM (PKCS # 12--pem)

OpenSSL PKCS12-in certificate. pfx-out certificate. Cer
If you do not need to encrypt the private key in PEM, you can add option-nodes;
If you do not need to export the private key, you can add the option-nokeys;

PEM BASE64--X.509 text format

OpenSSL X509-in key. pem-text-out cert. pem

Extract the private key (. Key) from the pfx file)

OpenSSL PKCS12-In mycert. pfx-nocerts-nodes-out mycert. Key

PEM--SPC

OpenSSL crl2pkcs7-nocrl-certfile Venus. pem-outform der-Out Venus. SPC

PEM--PVK (supported by OpenSSL 1.x)

OpenSSL RSA-In mycert. pem-outform PVK-strong-out mypvk. PVK

PEM--PVK(For versions earlier than OpenSSL 1.x, you can download the PVK converter and run the following command to complete it)

PVK-in CA. Key-out ca. PVK-nocrypt-topvk

PVK format reference: http://www.drh-consultancy.demon.co.uk/pvk.html

For more options and functions of OpenSSL, see the OpenSSL manual.